GitLab Audit Logging Policy

Mon, 01 Jan 0001 00:00:00 +0000

Visibility: Audit

Purpose

To ensure the proper operation and security of GitLab.com, GitLab logs critical information system activity.

Scope

The audit logging policy applies to all systems within our production environment. The production environment includes all endpoints and cloud assets used in hosting GitLab.com and its subdomains. This may include third-party systems that support the business of GitLab.com.

GitLab Teleport Access Policy

Mon, 01 Jan 0001 00:00:00 +0000

Purpose

To ensure an audited access to our terminal/CLI tools like Database Access and Rails Console, GitLab uses Teleport.

Scope

The Teleport Access policy applies to all systems within our production environment that require a terminal or CLI access.

Roles & Responsibilities

Role	Responsibility
GitLab Team Members	Responsible for following the requirements in this policy
System Owners	Alignment to this policy
Code Owners	Responsible for approving changes and exceptions to this policy

Procedure

Teleport access is managed through Okta and is provided as part of a role’s baseline group assignment or through an access request with appropriate approval
Access reviews are performed on a quarterly basis to ensure that all users are appropriate and have appropriate access levels.
Teleport Audit Logs must be retained for a defined period of 1 year
Teleport Audit Logs must not be modified and or deleted before the defined time of 1 year
Access to Teleport Audit log data must be limited based on the principle of least privilege

Exceptions

Exceptions to this policy will be tracked as per the Information Security Policy Exception Management Process

Security_policy_au on The GitLab Handbook

GitLab Audit Logging Policy

Purpose

Scope

GitLab Teleport Access Policy

Purpose

Scope

Roles & Responsibilities

Procedure

Exceptions