Security_standard_acia on The GitLab Handbook

Access Requests (ARs)

Mon, 01 Jan 0001 00:00:00 +0000

Visibility: Audit

Access Requests are owned by the IT team, while onboarding, offboarding and internal transition requests are owned by the People Operations Team.

If you have any access requests related questions, please reach out to #it_help or the tool provisioner in Slack.

Get Started

All open and closed ARs can be found in the access-requests project, and you can create a new issue here.

Access Review Procedure

Mon, 01 Jan 0001 00:00:00 +0000

Visibility: Audit

Purpose

GitLab’s user access review is an important control activity required for internal and external IT audits, helping to minimize threats, and provide assurance that the right people have the right access to critical systems and infrastructure. This procedure details process steps and provides control owner guidance for access reviews.

Benefits to the organization

Reduces security risk
Identifies dormant and/or disabled accounts
Ensures only required team members have access to a system
Validates users who have changed roles have not retained access no longer relevant
Ensures terminated team members no longer can access company systems
Supports GitLab compliance and regulatory requirements which maintains customer trust

Scope

In-Scope Systems

Security Compliance performs Access Reviews for in-scope systems based on a subset of factors. Including:

GitLab Password Standards

Mon, 01 Jan 0001 00:00:00 +0000

Visibility: Audit

Purpose

This document outlines information security password standards intended to protect GitLab information systems and other resources containing confidential (Red and Orange) GitLab data from unauthorized use, where technically feasible.

Scope

Applies to all GitLab team members, contractors, advisors, and contracted parties interacting with GitLab computing resources and accessing confidential data.

Roles & Responsibilities

Role	Responsibility
GitLab Team Members	Responsible for adhering to the requirements outlined in this standard
Security	Responsible for defining and monitoring implementation of these standards for critical applications
Security Management (Code Owners)	Responsible for approving significant changes and exceptions to these standards

Standard

Constructing secure passwords and ensuring proper password management is essential. GitLab’s password standards are based, in part, on the recommendations by NIST 800-63B. To learn what makes a password truly secure, read this article or watch this conference presentation on password strength.

Security_standard_acia on The GitLab Handbook

Access Requests (ARs)

Access requests related pages

Get Started

Access Review Procedure

Purpose

Benefits to the organization

Scope

In-Scope Systems

GitLab Password Standards

Purpose

Scope

Roles & Responsibilities

Standard