SEC01-BP06 Automate deployment of standard security controls
Define standard security controls and configurations as infrastructure as code, version control them, test them in a pipeline and deploy them automatically across environments.
4
artefacts
2
held by a system
0
at each review
easy
to go live
Source control / CI pipeline
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- CI/CD pipeline definition showing security tests before deploy · Source control / CI pipeline
- Drift detection and alerting configuration · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- IaC templates holding the standard security baseline · Policy repository / GRC workspace
- Version control history for those templates · Policy repository / GRC workspace
First move
Automate the pull from your Source control / CI pipeline. Pull-request approvals, pipeline test results and deployment records from source control, per release.
Common gaps auditors find
- console-applied security settings that no template reproduces
- no pipeline gate so untested changes reach production
- drift never detected because no baseline comparison runs
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSEC01-BP05 Reduce security management scope · SEC01-BP07 Identify threats and prioritize mitigations using a threat model