PO.5.1 Secure Development Environment Implementation
Implement and maintain secure environments for software development including source code repositories, build systems, and developer endpoints. Apply the same controls expected of production where the data sensitivity wa
4
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring coverage for development infrastructure · SIEM / log platform
periodic reviewEvidence produced at each review
- Source control access review records · Identity provider / directory
governing documentDocuments that govern the control
- Developer endpoint hardening standard · Policy repository / GRC workspace
- Build environment isolation design · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- developer laptops less monitored than production
- build agents share network space with corporate IT
- code signing keys held on developer endpoints
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPO.4.2 Gather and Safeguard Security Check Information · PO.5.2 Harden Development Endpoints