Organisational Policies - Security in CI/CD Pipelines

The effective adoption of Chapter 07 - Secure CI/CD - requires the existence of formal organisational policies that regulate, legitimise and sustain the security practices applicable to the continuous integration and delivery chain.

---

📌 Fundamental note

⚠️ The technical practices prescribed in this chapter (e.g. execution control, secret injection, artefact validation, segregation of pipelines) must be formally legitimised by approved and auditable organisational policies.

These policies:

• Make the proportional application of security controls by risk level mandatory;
• Establish clear rules for the secure execution of pipelines, avoiding ad hoc decisions;
• Enable audit of the provenance of artefacts and validation of the critical build and deploy stages.

🧩 This chapter implements the practices; the policies provide the normative and binding basis to ensure that they are correctly applied.

📎 The existence of policies on CI/CD security is an explicit requirement or a strong recommendation in frameworks such as SLSA, SSDF, OWASP DSOMM and ENISA guides.

---

🧾 Recommended policies

Policy Name	Mandatory?	Application	Summary of the required content
Secure Pipeline Execution Policy	✅ Yes	All CI/CD pipelines	Rules for authorised execution; permitted runners; control by branch/context; events that trigger builds.
Environment and Runner Segregation Policy	✅ Yes	DevOps, Security, Cloud teams	Isolation rules by project/trust; dedicated runners; prohibition of cross execution without approval.
Secret Injection and Protection Policy	✅ Yes	The whole organisation	Origin and management of secrets; prohibition of hardcoded secrets; masking in logs; integration with vaults.
Artefact Validation and Provenance Policy	✅ Yes	Repositories, pipelines, staging/prod environments	Generation and verification of provenance; hash and signature; rules for promotion between environments.
Pipeline Review Policy	⚠️ Optional	Organisations with shared pipelines	Mandatory peer review; change control; technical approval of templates.
Risk-Proportional Application Policy	⚠️ Optional	Organisations with formal classification	Mapping between risk level and minimum controls required in the pipeline.

---

📋 Suggested structure of each policy

Each organisational policy must contain, at a minimum:

• Objective and scope (application to pipelines, environments, teams, artefact types);
• Mandatory criteria and explicit permissions (e.g. authorised runners, sources of secrets, deploy rules);
• Roles and responsibilities (DevOps, Security, AppSec, product owners);
• Mechanisms for recording, validation and traceability (e.g. provenance, execution logs, approval of exceptions);
• Rules for periodic review of the policy (e.g. annual review, or after incidents).

---

✅ Final recommendations

• The policies must be officially approved by technical and security management;
• They must be accessible to all teams involved in the pipelines and deliveries;
• Their existence is a necessary condition to guarantee the maturity and auditability of the CI/CD cycle;
• Their application must be visible in the practices defined in this chapter, with a direct link to controls and validations in the pipeline.

📌 Templates for these policies may be made available as 60-*.md files in future versions of the manual.