Does your organization implement controls to protect all components of internally developed software from tampering and unauthorized access throughout the software development lifecycle?

This question assesses whether your organization has implemented safeguards to prevent unauthorized modifications to source code, build systems, deployment pipelines, and other software components. Effective controls might include code signing, access restrictions to repositories, secure build environments, integrity verification mechanisms, and change management processes. Evidence could include documentation of your secure software development lifecycle (SDLC) process, access control lists for code repositories, code signing certificates and procedures, integrity verification reports, and change management logs showing approval workflows for code modifications.