SEC06-BP02 Provision compute from hardened images
Provision compute from hardened baseline images and obtain runtime dependencies such as container images and libraries only from trusted registries with verified signatures.
4
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Image patch and rebuild cadence records · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Golden image build pipeline definition and hardening standard applied · Policy repository / GRC workspace
- Private registry inventory and access policy · Policy repository / GRC workspace
- Signature verification step in the build or admission path · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- instances built from unmanaged public images
- container images pulled straight from public registries at deploy time
- no signature verification so tampered artefacts run undetected
- golden images never rebuilt so they drift out of patch
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSEC06-BP01 Perform vulnerability management · SEC06-BP03 Reduce manual management and interactive access