Contributions
Implementation examples
Every example is tied to a specific control and, ideally, to the individual assessment objectives it claims to satisfy. Verdicts and reasoning are attached to each one.
2 examples referencing CI/CD
- CM.L2-3.4.6[a] [b]
Role-shaped images: each server role ships only the packages that role needs
AO coverage. Addresses both Least Functionality objectives: essential capabilities are defined per role, and systems are configured to provide only those. Defining essential capabilities [a]. Each…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.5[a] [b] [e] [f] [g] [h]
Only the deployment pipeline can write to production; humans hold review rights
AO coverage. Claims the logical access restriction objectives [e] defined, [f] documented, [g] approved, and [h] enforced, plus [a] and [b] — physical restrictions are defined and documented for the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet