Theme 2: Build environment security
This theme ensures appropriate steps are taken to prevent the build environment from being accessed by a person (or machine) without a legitimate need. This helps prevent interference with the software during the build and release process. The 'build environment' refers to the environment where software is compiled, built and packaged ready for release. This should be logically or physically separate from areas where code is written and tested.
Principle 2.1 Protect the build environment against unauthorised access
| Reference | Principles/Claims | Evidence |
|---|---|---|
| Claim 2.1.1 | Roles are defined that specify the data and functionality that each role is allowed to access. | Yes. VPN access, IP restrictions block global access. Role based permissions to access repositories, development systems and data stores. Granular where applicable |
| Claim 2.1.2 | Users of the build environment are required to authenticate on a regular basis. | All staff must login to a secure work device. Access systems via secure VPN with MFA and login to services/systems. |
| Claim 2.1.3 | Users of the build environment are issued with credentials bound to their role. | Yes, all servers/environments require credentials and have role-based access. Platform access also has separate credentials and role-based access per user per environment. |
| Claim 2.1.4 | Credentials are securely managed and stored. | Yes - pleasant password |
| Claim 2.1.5 | Credentials are multi factor. | Yes |
Principle 2.2 Control and log changes to the build environment
| Reference | Principles/Claims | Evidence |
|---|---|---|
| Claim 2.2.1 | Access and changes to the build environment are logged. | Yes, server events/access logs. Device logs/VPN logs. ICM security logs. |
| Claim 2.2.2 | Only authorised personnel can make changes to the build environment. | Yes. Access to build infrastructure and associated configuration is restricted through role-based access controls. Only authorised personnel with approved business need are granted permissions to modify build pipelines, build servers and related configurations. |
| Claim 2.2.3 | Logs are auditable and retained for an agreed period. | Yes. Security and audit logs are retained in accordance with organisational retention policies and can be retrieved for investigation, audit and incident response activities. |
| Claim 2.2.4 | The confidentiality and integrity of logs is protected. | Yes. Access to logs is restricted to authorised personnel. Logging platforms employ access controls and system protections designed to prevent unauthorised modification or deletion of audit records. |
Last modified on 27 October 2026
