SFS 8 / SF 4

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all secrets used during software development and deployment managed through secure centralized storage with strict access controls and audit logging throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Secrets managed via approved centralized vault with access controls, audit logs, and rotation policies

Assessment criterion and evidence

Actor: organization. Scope: software development and deployment environments. Evidence period: review period. Required evidence: Documented secrets management policy; Vault configuration records; Access control logs demonstrating segregation. Negative criterion: Secrets hardcoded in source code, stored in insecure locations, or lacking access controls/audit. Missing evidence: pending assessment

View the JSON record (opens in a new tab).

Assessment result: unset.