CM-11: Production Deployment Access Control

Control Description

Access to promote changes into the production environment related to the in-scope applications and related databases is limited to appropriate individuals without the ability to edit the source code.

Plain Meaning

Only specific people should be able to deploy changes to production, and these people should not have the ability to modify the source code directly. This separation of duties ensures that those who can deploy to production cannot make unauthorized code changes, and those who can write code cannot deploy to production without proper review and approval.

---

Branch Protection Rules

1. Go to your repository’s settings.
2. Under “Branches,” add a protection rule for your production branch (e.g., ‎main or ‎prod).
3. Enable “Restrict who can push to matching branches.”
4. Select only the specific GitHub user or team allowed to push.

Audit and Monitor

• Use GitHub’s audit logs to track who pushes to production.
• Regularly review permissions and access.

Related Links

• GitHub Audit Log
• GitHub Actions Security