E.3 Secure software development environment

Protect the software development environment from internal and external threats that can lead to compromise.

Controls

E.3.1 Authentication

Enable authorization, traceability, and non-repudiation

E.3.2 Environmental separation

Separate and protect each environment involved in software development (i.e., development, build, test, deployment, model training)

E.3.3 Role-based access control

Controlling access to resources where permitted actions on resources are identified with roles rather than with individual subject identities; provide traceability between actors and actions

E.3.4 Information flow enforcement

Limit the information flow across trust boundaries to participants in the supply chain

E.3.5 Baseline configuration

Provide the starting point for tracking changes to components, code, and settings throughout the SDLC

E.3.6 Monitor changes to configuration settings

Prevent the tapering of information systems and networks through the monitoring of changes to configuration settings.

E.3.7 Boundary protection

Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system.

E.3.8 Key rotation

Limit the impact if a key is compromised.

E.3.9 Ephemeral credentials

Reduce the number of potential entry points for a hacker, as well as the attack surface.

E.3.10 Establish a root of trust

Provide the foundation for secure operations of a computing system