PS.1.1: Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.
Example 1: Store all source code and configuration-as-code in a code repository, and restrict access to it based on the nature of the code. For example, open-source code intended for public access may need its integrity and availability protected; other code may also need its confidentiality protected.
Example 2: Use version control features of the repository to track all changes made to the code with accountability to the individual account.
Example 3: Use commit signing for code repositories.
Example 4: Have the code owner review and approve all changes made to the code by others.
Example 5: Use code signing to help protect the integrity of executables.
Example 6: Use cryptography (e.g., cryptographic hashes) to help protect file integrity.
Description
Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.