IM-8 Restrict the exposure of credential and secrets
Ensure developers handle credentials and secrets securely, keeping them out of code and configuration files, storing them in a secure key store and scanning source for exposed credentials.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Source control / CI pipeline
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Pre-commit or pipeline gate blocking committed secrets · Source control / CI pipeline
periodic reviewEvidence produced at each review
- Rotation records for any credential found exposed · Identity provider / directory
governing documentDocuments that govern the control
- Secret store in use and application integration pattern · Document repository
- Secret scanning enabled on repositories and its findings history · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Source control / CI pipeline); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- connection strings in configuration files committed to source control
- secret scanning enabled but findings never triaged
- exposed credentials removed from the current commit but never rotated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIM-7 Restrict resource access based on conditions · IM-9 Secure user access to existing applications