P.3.5 Prevent component vetting bypass
Control Details
Objective
Ensure developers are not bypassing the component vetting process
Definition
Audit to ensure developers are consuming components that have gone through the approved vetting process even on their own machines because developer endpoints can become infected. Restrict product build to only packages in the repository of vetted components.
Assessment Questions
- In what ways could a developer bypass the component vetting process?
- What are the mechanisms in place to monitor whether developers are consuming third party code through the approved ingestion method and not bypassing the vetting process?