CIS GitHub Benchmark v1.0.0
117 articles
- Ensure Track All Code Changes Using a Version Control System
- Ensure Trace Code Changes to Their Corresponding Tasks or Issues
- Ensure Enforce Two-Person Code Change Approval with Strong Authentication
- Ensure Invalidate Prior Approvals Upon Code Change Updates
- Ensure Restrict Permissions for Dismissing Code Review Approvals
- Ensure Prohibit Use of Default Passwords for Accounts and Systems
- Ensure Restrict and Control Access to Production Environments
- Ensure Maintain Reproducible and Consistent Deployment Environments
- Ensure Implement Automated Deployment Processes
- Ensure Pin Deployment Configuration Manifests to Verified Versions
- Ensure Assign Code Owners for Sensitive Code and Configuration
- Ensure Verify Integrity and Authenticity of Deployment Configuration Manifests
- Ensure Require Code Owner Approval for Changes to Owned Code
- Ensure Perform Security Scanning of Infrastructure as Code Configurations
- Ensure Restrict and Control Access to Deployment Configuration Files
- Ensure Implement Scanning to Detect and Prevent Sensitive Data in Deployment Configurations
- Ensure Periodic Review and Cleanup of Inactive Branches
- Ensure Require Successful Checks Before Code Merge
- Ensure Audit All Changes to Deployment Configuration Files
- Ensure Segregate Deployment Configuration Files from Application Source Code
- Ensure Embed Provenance Metadata in Build Artifacts
- Ensure Implement Security Controls for Repository Webhooks
- Ensure Audit All Modifications to Package Registry Configuration
- Ensure Validate Signatures of All Artifact Versions Before Use
- Ensure Validate Signatures of All Artifacts Before Package Registry Upload
- Ensure Limit and Manage Administrator Accounts for Package Registry
- Disable Anonymous Access to Package Artifacts
- Ensure Enforce Centralized User Management for Package Registry Access
- Ensure Enforce Multi-Factor Authentication for Package Registry Access
- Ensure Restrict Upload Permissions to Minimum Necessary Users
- Ensure Restrict Artifact Certification Authority to Authorized Personnel
- Ensure Restrict Artifact Decryption to Authorized Platforms Only
- Ensure Encrypt Artifacts Prior to Distribution
- Ensure Automate Artifact Signing within the Build Pipeline
- Ensure Automate Detection of Package Ownership Changes
- Ensure Automate License Compliance Scanning of Packages
- Ensure Automate Vulnerability Scanning of Software Packages
- Implement and Enforce a Global Dependency Usage Policy
- Ensure Enforce Minimum Package Age of 60 Days Before Use
- Ensure Enforce Version Pinning of Dependencies for Stability and Security
- Ensure Provide a Digitally Signed SBOM for Software Deliverables
- EnsureDefine and Prioritize Trusted Package Managers and Repositories
- Ensure Monitor and Manage Dependencies Among Open-Source Components
- Ensure Require and Verify Digital Signatures on Build Metadata
- Ensure Mandate SBOM Submission from Third-Party Software Suppliers
- Ensure Authenticity and Integrity of Third-Party Artifacts and Open-Source Libraries
- Enforce Digital Signing of SBOMs Within Build Pipelines
- Ensure Generate Software Bill of Materials (SBOM) During Build Pipeline
- Ensure Enforce Reproducible Builds in the Build Pipeline
- Ensure Validate Software Dependencies Prior to Integration
- Ensure Enforce Locking of External Dependencies in Build Processes
- EnsureMandate Digital Signing of Artifacts for Every Release
- Ensure Implement Automated Scanning to Detect Sensitive Data in Pipeline Files
- Ensure Implement Automated Vulnerability Scanning in Build Pipelines
- Ensure Implement Automated Misconfiguration Scanning in Build Pipelines
- Ensure Restrict Permissions for Triggering Build Processes
- Ensure Track and Review Modifications to Pipeline Configuration Files
- Ensure Store Build and Pipeline Outputs in Isolated and Secure Repositories
- Ensure Define and Document Inputs and Outputs for Each Build Stage
- Ensure Implement Build Pipelines as Code for Consistency and Traceability
- Ensure Monitor and Manage Resource Usage of Build Workers
- Ensure Version Control for Build Worker Deployment Configurations
- Ensure Implement Automated Vulnerability Scanning for Build Workers
- Ensure Implement Run-Time Security Controls for Build Worker Environments
- Ensure Restrict Network Access of Build Workers to Minimum Required
- Implement Segregation of Duties Among Build Workers
- Ensure Use Push-Based Deployment of Build Environments and Commands
- Ensure Enforce Single-Use Build Worker Instances for Builds
- Ensure Limit and Manage Administrator Accounts for Build Environment
- Ensure Implement Security Measures to Protect Build Environment Webhooks
- Ensure Enforce Prohibition of Default Passwords on Systems and Applications
- Ensure Implement Automated Vulnerability Scanning for Build Infrastructure
- Enforce Principle of Least Privilege for Build Secrets
- Ensure Enforce User Authentication for Build Environment Access
- Ensure Restrict Access to Build Environments to Authorized Personnel Only
- Ensure Automate Build Environment Provisioning
- Ensure Implement Logging of Build Environment Details
- Enforce Immutability of Pipeline Infrastructure and Configuration
- Design Pipelines with Single, Clear Responsibilities
- Ensure Implement Automated Scanning for Open-Source License Compliance
- Ensure Implement Automated Scanning for Open-Source Package Vulnerabilities
- Ensure Implement Automated Code Vulnerability Scanning
- Ensure Implement Security Scanning for CI Pipeline Configurations
- Ensure Require Branches to Be Updated with Base Before Merge
- Ensure Require Resolution of All Code Review Comments Before Merge
- Ensure Enforce Verification of GPG-Signed Commits Prior to Merge
- Ensure Enforce Linear Commit History in Version Control
- Ensure Enforce Branch Protection Policies for Administrator Accounts
- Ensure Restrict Code Push and Merge Permissions to Authorized Users
- Ensure Prevent Force Pushes to Protected Branches
- Ensure Prevent Unauthorized Branch Deletions
- Ensure Automate Risk Scanning of Code Merges
- Ensure Audit All Modifications to Branch Protection Settings
- Ensure Enforce Protection Rules on the Default Branch
- Ensure Mandate SECURITY.md File in Public Repositories
- Ensure Restrict Repository Creation Permissions to Authorized Users
- Ensure Restrict Repository Deletion Permissions to Authorized Users
- Ensure Restrict Issue Deletion Permissions to Authorized Users
- Ensure to Maintain Visibility and Control Over All Code Forks
- Ensure Monitor and Audit Visibility Changes of Code Projects
- Ensure Periodic Review and Removal of Inactive User Accounts
- Ensure Restrict Team Creation Permissions to Authorized Users
- Ensure Limit and Manage Administrator Accounts in the Organization
- Ensure MFA for All Code Contributors
- Ensure Multi-Factor Authentication for All Organization Members
- Ensure Restrict Member Invitations to Company-Approved Email Addresses
- Ensure Maintain a Minimum of Two Administrators Per Repository
- Ensure Strict Default Permissions on Repositories
- Ensure to Confirm and Display Organization Verification Status
- Ensure Restrict SCM Email Notifications to Verified Email Domains
- Ensure Implement and Manage SSH Certificate-Based Authentication
- Ensure Restrict Git Access Using IP Address Filtering
- Ensure Monitor and Track Anomalous Code Behavior
- Ensure Require Administrator Approval for Application Installations
- Ensure Enforce Least Privilege Access for Installed Applications
- Ensure Enforce Security Controls for All Webhooks
- Ensure Implement Sensitive Data Detection and Prevention Scanners in Codebases