GitLab ensures security hardening and baseline configuration standards have been established according to industry standards and are reviewed and updated quarterly.
Baseline hardening standards make it clear how systems should be hardened and configured. To ensure we these standards are always relevant, we need to regularly review these documents and update them as needed. The goal of this control is to remove as much subjectivity as possible from the process of configuring systems. If we create a standard for each system type within GitLab, it will be easier to automate system configuration and ensure that all systems are configured the same. This consistent configuration becomes critical when critical vulnerabilities are discovered and need to be rapidly deployed to all applicable systems.
This control applies to all hosted systems (e.g. VM's and GCP compute services) as well as end user workstations (e.g. GitLab team-members' MacBooks).
For detailed implementation guidance relevant to GitLab team-members, refer to the full guidance documentation.
For all reference links relevant to this control, refer to the full guidance documentation.
For examples of evidence an auditor might request, refer to the full guidance documentation.