(for instances, groups, and projects): Configure approvals required for
merge requests.
-[**Push rules**](../push_rules/push_rules.md)(for instances, groups, and
projects): Control pushes to your repositories.
- Separation of duties using [**protected branches**](../user/project/protected_branches.md#require-code-owner-approval-on-a-protected-branch)
- Separation of duties using [**protected branches**](../user/project/protected_branches.md#require-code-owner-approval-on-a-protected-branch)
and [**custom CI/CD configuration paths**](../ci/pipelines/settings.md#specify-a-custom-cicd-configuration-file)(for projects):
and [**custom CI/CD configuration paths**](../ci/pipelines/settings.md#specify-a-custom-cicd-configuration-file)(for projects): Users can leverage the GitLab cross-project YAML configurations
Users can leverage the GitLab cross-project YAML configurations to define deployers of code and developers of code.
to define deployers of code and developers of code. See how to use this setup
See how to use this setup to define these roles in:
to define these roles in:
- The [Separation of Duties deploy project](https://gitlab.com/guided-explorations/separation-of-duties-deploy/blob/master/README.md).
- The [Separation of Duties deploy project](https://gitlab.com/guided-explorations/separation-of-duties-deploy/blob/master/README.md).
- The [Separation of Duties project](https://gitlab.com/guided-explorations/separation-of-duties/blob/master/README.md).
- The [Separation of Duties project](https://gitlab.com/guided-explorations/separation-of-duties/blob/master/README.md).
## Compliant workflow automation
## Compliant workflow automation
It is important for compliance teams to be confident that their controls and requirements are set up correctly, but also that they _stay_ set up correctly. One way of doing this is manually checking settings periodically, but this is error prone and time consuming. A better approach is to use single-source-of-truth settings and automation to ensure that whatever a compliance team has configured, stays configured and working correctly. These features can help you automate compliance:
It is important for compliance teams to be confident that their controls and
requirements are set up correctly, but also that they _stay_ set up correctly.
One way of doing this is manually checking settings periodically, but this is
error prone and time consuming. A better approach is to use single-source-of-truth
settings and automation to ensure that whatever a compliance team has configured,
stays configured and working correctly. These features can help you automate
compliance:
-[**Compliance frameworks**](../user/project/settings/index.md#compliance-frameworks)(for groups): Create a custom
-[**Compliance frameworks**](../user/project/settings/index.md#compliance-frameworks)(for groups): Create a custom
compliance framework at the group level to describe the type of compliance requirements any child project needs to follow.
compliance framework at the group level to describe the type of compliance requirements any child project needs to follow.
...
@@ -45,46 +57,59 @@ It is important for compliance teams to be confident that their controls and req
...
@@ -45,46 +57,59 @@ It is important for compliance teams to be confident that their controls and req
## Audit management
## Audit management
An important part of any compliance program is being able to go back and understand what happened, when
An important part of any compliance program is being able to go back and understand
it happened, and who was responsible. This is useful in audit situations as well as for understanding
what happened, when it happened, and who was responsible. This is useful in audit
the root cause of issues when they occur. It is useful to have both low-level, raw lists of audit data
situations as well as for understanding the root cause of issues when they occur.
as well as high-level, summary lists of audit data. Between these two, compliance teams can quickly
It is useful to have both low-level, raw lists of audit data as well as high-level,
identify if problems exist and then drill down into the specifics of those issues. These features can help provide visibility into GitLab and audit what is happening:
summary lists of audit data. Between these two, compliance teams can quickly
identify if problems exist and then drill down into the specifics of those issues.
These features can help provide visibility into GitLab and audit what is happening:
-[**Audit events**](audit_events.md)(for instances, groups, and projects): To maintain the integrity of your code,
-[**Audit events**](audit_events.md)(for instances, groups, and projects): To
audit events give administrators the ability to view any modifications made within the GitLab
maintain the integrity of your code, audit events give administrators the
server in an advanced audit events system, so you can control, analyze, and track every change.
ability to view any modifications made within the GitLab server in an advanced
-[**Audit reports**](audit_reports.md)(for instances, groups, and projects): Create and access reports based on the
audit events system, so you can control, analyze, and track every change.
audit events that have occurred. Use pre-built GitLab reports or the API to build your own.
-[**Audit reports**](audit_reports.md)(for instances, groups, and projects):
-[**Auditor users**](auditor_users.md)(for instances): Auditor users are users who are given read-only access to all
Create and access reports based on the audit events that have occurred. Use
projects, groups, and other resources on the GitLab instance.
pre-built GitLab reports or the API to build your own.
-[**Compliance report**](../user/compliance/compliance_report/index.md)(for groups): Quickly get visibility into the
-[**Auditor users**](auditor_users.md)(for instances): Auditor users are users
compliance posture of your organization.
who are given read-only access to all projects, groups, and other resources on
