SLC-03—Secrets in Code

>Control Description

Organization manages source code secrets in a centralized repository; secrets are rotated at least annually and immediately if the security of secrets is compromised.

Theme

Process

Type

Preventive

Policy/Standard

Secure Development Lifecycle Policy

>Implementation Guidance

1. Each service should have a central source code repository where all secrets are managed. 2. Secrets of the service are rotated once every year and in cases where the securiy of secrets is compromised. Logs for the same are maintained and documented.

>Testing Procedure

1. For a sample of services, inspect the Organization's centralized repository to determine that source code secrets are managed in a centralized repository. 2. Obtain evidence to validate secrets are rotated at least annually and immediately if the security of secrets is compromised.