[{"data":1,"prerenderedAt":973},["ShallowReactive",2],{"/blog/creating-the-gitlab-controls-framework":3,"navigation-en-us":187,"banner-en-us":615,"footer-en-us":625,"blog-post-authors-en-us-Jeff Burrows":870,"blog-related-posts-en-us-creating-the-gitlab-controls-framework":885,"blog-promotions-en-us":910,"next-steps-en-us":963},{"id":4,"title":5,"authors":6,"body":8,"category":166,"date":167,"description":168,"extension":169,"externalUrl":170,"faq":170,"featured":171,"heroImage":172,"meta":173,"navigation":174,"path":175,"seo":176,"slug":181,"stem":182,"tags":183,"template":185,"updatedDate":170,"__hash__":186},"blogPosts/en-us/blog/creating-the-gitlab-controls-framework.md","Turning the Adobe CCF into the GitLab Control Framework (it's all open source!)",[7],"Jeff Burrows",{"type":9,"value":10,"toc":156},"minimark",[11,27,32,35,44,49,52,55,58,86,95,99,108,111,115,130,133,147],[12,13,14,15,20,21,26],"p",{},"In my previous blog post, I talked about ",[16,17,19],"a",{"href":18},"/blog/choosing-a-compliance-framework/","how GitLab went about choosing an overarching compliance framework"," that would optimize satisfying the requirements of underlying regulatory or industry best practice requirements. Today I’m blogging about the next steps in that process, and will walk through how we implemented the ",[16,22,25],{"href":23,"rel":24},"https://blogs.adobe.com/security/2017/05/open-source-ccf.html",[],"Adobe open source compliance framework (CCF)"," and adapted it to our needs, resulting in the GitLab Control Framework (GCF).",[28,29,31],"h2",{"id":30},"implementation-and-adaptation","Implementation and adaptation",[12,33,34],{},"When you download the Adobe CCF you get two PDF documents: a whitepaper on the state of compliance at Adobe and a table of all the generic CCF controls. The first thing we did was to convert the CCF controls PDF to a CSV so we could more easily make changes to the data. Most of these changes were to make the control statements specific to GitLab and our compliance needs.",[12,36,37,38,43],{},"We were careful when making changes to ensure that we weren't changing anything foundational about the statement, as this could break the mapping to underlying requirements. For example, ",[16,39,42],{"href":40,"rel":41},"https://www.pcisecuritystandards.org/documents/ASV_Program_Guide_v3.0.pdf",[],"PCI DSS"," states that an organization must “run internal and external network vulnerability scans at least quarterly and after any significant change in the network (such as new system component installations, changes in network topology, firewall rule modifications, product upgrades).” If you were to make the frequency of the Vulnerability Scans control “annual” instead of “quarterly,” that control would no longer map to PCI DSS control 11.2 since that underlying PCI control requires at least quarterly scanning.",[45,46,48],"h3",{"id":47},"now-we-have-a-set-of-security-controls-specific-to-gitlabs-compliance-needs","Now we have a set of security controls specific to GitLab’s compliance needs",[12,50,51],{},"We found it helpful to create a prefix for each domain (e.g. AM for Asset Management, BC for Business Continuity, etc.) of controls and use these to create control numbers for each control (e.g. AM.1.01, BC.1.04, etc.). With this information in place, the real fun started.",[12,53,54],{},"There are 184 default controls. This number will expand or contract based on your individual needs. For example, if you have a need for FedRamp certification you might have different control requirements than an organization that doesn't. This is a lot of controls to try and roll out all at once, and most organizations don’t need to address all of the underlying control frameworks simultaneously. At GitLab, we knew that a SOC2 certification was the first compliance priority for us and, based on these needs, we started by prioritizing all controls that mapped to SOC2’s Common Criteria. This gave us a list of 63 controls – a much more manageable starting point.",[12,56,57],{},"For these 63 controls we wanted to build out additional content relating to each. In particular, we wanted a Markdown file that addressed each of the following topics for each control:",[59,60,61,65,68,71,74,77,80,83],"ul",{},[62,63,64],"li",{},"Control Statement",[62,66,67],{},"Context",[62,69,70],{},"Scope",[62,72,73],{},"Ownership",[62,75,76],{},"Implementation Guidance",[62,78,79],{},"Reference Links",[62,81,82],{},"Examples of evidence an auditor might request to satisfy this control",[62,84,85],{},"Framework Mapping",[12,87,88,89,94],{},"Most of this information can be seen within the ",[16,90,93],{"href":91,"rel":92},"https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/sec-controls/",[],"security control pages in our handbook","; however, some of these topics contain sensitive information so we have a repo only accessible to GitLab team members.",[45,96,98],{"id":97},"the-last-steps-in-this-implementation-process-were-to","The last steps in this implementation process were to:",[100,101,102,105],"ol",{},[62,103,104],{},"Identify the teams within GitLab that were responsible, accountable, consulted, and informed for each of our 63 prioritized controls, and then",[62,106,107],{},"Perform a gap analysis for each of these controls to see what our starting point was for each, in terms of our state of compliance.",[12,109,110],{},"The above steps each build on the previous ones, and help to ensure enough baseline context and requirements were established and that we understood the context and scope for each control sufficiently to perform the gap analysis.",[28,112,114],{"id":113},"adopting-the-gcf-and-future-plans","Adopting the GCF and future plans",[12,116,117,118,123,124,129],{},"Our goal in sharing the details behind our compliance framework implementation is to lessen the adoption effort for smaller companies and GitLab customers alike. We’ve created a ",[16,119,122],{"href":120,"rel":121},"https://gitlab.com/gitlab-com/gl-security/public-gcf",[],"public repo that has a copy of the csv file we adapted from the Adobe CCF"," and a link to a view-only ",[16,125,128],{"href":126,"rel":127},"https://docs.google.com/spreadsheets/d/1xmACTt5WD_u8OL0z8G0oUv7Di9J4DWHuy2kamch_7-g/edit#gid=907478311",[],"Google Sheet with all of these controls and variables in place"," to make adaptation to your organization as easy as possible.",[12,131,132],{},"We’re currently working on scripts that turn SOC2 and HIPAA-related controls into individual issues within a GitLab project. We’re also working on a CSV-to-JSON tool that would easily convert the control CSV into a large data blob, making deployment for certain organizations easier.",[12,134,135,139,140,139,144],{},[136,137,138],"strong",{},"We plan to make these tools available as they are ready but we also want to hear from you."," ",[141,142,143],"em",{},"What features would make the adoption of these controls easier? How are you using GitLab to help with your compliance needs? What else can GitLab contribute to the security compliance industry to help companies of all sizes align with security best practices and reduce the effort needed for external security validations/certifications?",[136,145,146],{},"Leave us a comment below!",[12,148,149,150,155],{},"Photo by ",[16,151,154],{"href":152,"rel":153},"https://unsplash.com/@pixelsucker?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText",[],"geraldo stanislas"," on Unsplash",{"title":157,"searchDepth":158,"depth":158,"links":159},"",2,[160,165],{"id":30,"depth":158,"text":31,"children":161},[162,164],{"id":47,"depth":163,"text":48},3,{"id":97,"depth":163,"text":98},{"id":113,"depth":158,"text":114},"security","2019-07-10","We've implemented and adapted an open source compliance framework. Now we're sharing our process and tools so you can adapt and customize it too.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749683200/Blog/Hero%20Images/geraldo-stanislas-unsplash.jpg",{},true,"/en-us/blog/creating-the-gitlab-controls-framework",{"title":177,"description":168,"ogTitle":177,"ogDescription":168,"noIndex":171,"ogImage":172,"ogUrl":178,"ogSiteName":179,"ogType":180,"canonicalUrls":178},"Adobe CCF becomes GitLab's open source control framework","https://about.gitlab.com/blog/creating-the-gitlab-controls-framework","https://about.gitlab.com","article","creating-the-gitlab-controls-framework","en-us/blog/creating-the-gitlab-controls-framework",[184,166],"open source","BlogPost","w-CXEI7fP0FF9ryhv5O98Da1CXEe6Ik3pUKYPzjAgqs",{"logo":188,"freeTrial":193,"sales":198,"login":203,"items":208,"search":535,"minimal":566,"duo":585,"switchNav":594,"pricingDeployment":605},{"config":189},{"href":190,"dataGaName":191,"dataGaLocation":192},"/","gitlab logo","header",{"text":194,"config":195},"Get free trial",{"href":196,"dataGaName":197,"dataGaLocation":192},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":199,"config":200},"Request a demo",{"href":201,"dataGaName":202,"dataGaLocation":192},"/sales/?contact-topic=request-demo","sales",{"text":204,"config":205},"Sign in",{"href":206,"dataGaName":207,"dataGaLocation":192},"https://gitlab.com/users/sign_in/","sign in",[209,238,338,343,457,513],{"text":210,"config":211,"menu":213},"Platform",{"dataNavLevelOne":212},"platform",{"type":214,"columns":215},"cards",[216,222,230],{"title":210,"description":217,"link":218},"The intelligent orchestration platform for DevSecOps",{"text":219,"config":220},"Explore our Platform",{"href":221,"dataGaName":212,"dataGaLocation":192},"/platform/",{"title":223,"description":224,"link":225},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":226,"config":227},"Meet GitLab Duo",{"href":228,"dataGaName":229,"dataGaLocation":192},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":231,"description":232,"link":233},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":234,"config":235},"Learn more",{"href":236,"dataGaName":237,"dataGaLocation":192},"/why-gitlab/","why gitlab",{"text":239,"left":174,"config":240,"menu":242},"Product",{"dataNavLevelOne":241},"solutions",{"type":243,"link":244,"columns":248,"feature":317},"lists",{"text":245,"config":246},"View all Solutions",{"href":247,"dataGaName":241,"dataGaLocation":192},"/solutions/",[249,273,296],{"title":250,"description":251,"link":252,"items":257},"Automation","CI/CD and automation to accelerate deployment",{"config":253},{"icon":254,"href":255,"dataGaName":256,"dataGaLocation":192},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[258,262,265,269],{"text":259,"config":260},"CI/CD",{"href":261,"dataGaLocation":192,"dataGaName":259},"/solutions/continuous-integration/",{"text":223,"config":263},{"href":228,"dataGaLocation":192,"dataGaName":264},"gitlab duo agent platform - product menu",{"text":266,"config":267},"Source Code Management",{"href":268,"dataGaLocation":192,"dataGaName":266},"/solutions/source-code-management/",{"text":270,"config":271},"Automated Software Delivery",{"href":255,"dataGaLocation":192,"dataGaName":272},"Automated software delivery",{"title":274,"description":275,"link":276,"items":281},"Security","Deliver code faster without compromising security",{"config":277},{"href":278,"dataGaName":279,"dataGaLocation":192,"icon":280},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[282,286,291],{"text":283,"config":284},"Application Security Testing",{"href":278,"dataGaName":285,"dataGaLocation":192},"Application security testing",{"text":287,"config":288},"Software Supply Chain Security",{"href":289,"dataGaLocation":192,"dataGaName":290},"/solutions/supply-chain/","Software supply chain security",{"text":292,"config":293},"Software Compliance",{"href":294,"dataGaName":295,"dataGaLocation":192},"/solutions/software-compliance/","software compliance",{"title":297,"link":298,"items":303},"Measurement",{"config":299},{"icon":300,"href":301,"dataGaName":302,"dataGaLocation":192},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[304,308,312],{"text":305,"config":306},"Visibility & Measurement",{"href":301,"dataGaLocation":192,"dataGaName":307},"Visibility and Measurement",{"text":309,"config":310},"Value Stream Management",{"href":311,"dataGaLocation":192,"dataGaName":309},"/solutions/value-stream-management/",{"text":313,"config":314},"Analytics & Insights",{"href":315,"dataGaLocation":192,"dataGaName":316},"/solutions/analytics-and-insights/","Analytics and insights",{"title":318,"type":243,"items":319},"GitLab for",[320,326,332],{"text":321,"config":322},"Enterprise",{"icon":323,"href":324,"dataGaLocation":192,"dataGaName":325},"Building","/enterprise/","enterprise",{"text":327,"config":328},"Small Business",{"icon":329,"href":330,"dataGaLocation":192,"dataGaName":331},"Work","/small-business/","small business",{"text":333,"config":334},"Public Sector",{"icon":335,"href":336,"dataGaLocation":192,"dataGaName":337},"Organization","/solutions/public-sector/","public sector",{"text":339,"config":340},"Pricing",{"href":341,"dataGaName":342,"dataGaLocation":192,"dataNavLevelOne":342},"/pricing/","pricing",{"text":344,"config":345,"menu":347},"Resources",{"dataNavLevelOne":346},"resources",{"type":243,"link":348,"columns":352,"feature":446},{"text":349,"config":350},"View all resources",{"href":351,"dataGaName":346,"dataGaLocation":192},"/resources/",[353,386,413],{"title":354,"items":355},"Getting started",[356,361,366,371,376,381],{"text":357,"config":358},"Install",{"href":359,"dataGaName":360,"dataGaLocation":192},"/install/","install",{"text":362,"config":363},"Quick start guides",{"href":364,"dataGaName":365,"dataGaLocation":192},"/get-started/","quick setup checklists",{"text":367,"config":368},"Learn",{"href":369,"dataGaLocation":192,"dataGaName":370},"https://university.gitlab.com/","learn",{"text":372,"config":373},"Product documentation",{"href":374,"dataGaName":375,"dataGaLocation":192},"https://docs.gitlab.com/","product documentation",{"text":377,"config":378},"Best practice videos",{"href":379,"dataGaName":380,"dataGaLocation":192},"/getting-started-videos/","best practice videos",{"text":382,"config":383},"Integrations",{"href":384,"dataGaName":385,"dataGaLocation":192},"/integrations/","integrations",{"title":387,"items":388},"Discover",[389,394,399,404,408],{"text":390,"config":391},"Customer success stories",{"href":392,"dataGaName":393,"dataGaLocation":192},"/customers/","customer success stories",{"text":395,"config":396},"Blog",{"href":397,"dataGaName":398,"dataGaLocation":192},"/blog/","blog",{"text":400,"config":401},"Demo Hub",{"href":402,"dataGaName":403,"dataGaLocation":192},"/demo-hub/","demo hub",{"text":405,"config":406},"The Source",{"href":407,"dataGaName":398,"dataGaLocation":192},"/the-source/",{"text":409,"config":410},"Remote",{"href":411,"dataGaName":412,"dataGaLocation":192},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":414,"items":415},"Connect",[416,421,426,431,436,441],{"text":417,"config":418},"GitLab Services",{"href":419,"dataGaName":420,"dataGaLocation":192},"/services/","services",{"text":422,"config":423},"Contribute",{"href":424,"dataGaName":425,"dataGaLocation":192},"https://contributors.gitlab.com","contribute",{"text":427,"config":428},"Community",{"href":429,"dataGaName":430,"dataGaLocation":192},"/community/","community",{"text":432,"config":433},"Forum",{"href":434,"dataGaName":435,"dataGaLocation":192},"https://forum.gitlab.com/","forum",{"text":437,"config":438},"Events",{"href":439,"dataGaName":440,"dataGaLocation":192},"/events/","events",{"text":442,"config":443},"Partners",{"href":444,"dataGaName":445,"dataGaLocation":192},"/partners/","partners",{"config":447,"title":450,"text":451,"link":452},{"background":448,"textColor":449},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":453,"config":454},"Read the latest",{"href":455,"dataGaName":456,"dataGaLocation":192},"/whats-new/","whats new",{"text":458,"config":459,"menu":461},"Company",{"dataNavLevelOne":460},"company",{"type":243,"columns":462},[463],{"items":464},[465,470,476,478,483,488,493,498,503,508],{"text":466,"config":467},"About",{"href":468,"dataGaName":469,"dataGaLocation":192},"/company/","about",{"text":471,"config":472,"footerGa":475},"Jobs",{"href":473,"dataGaName":474,"dataGaLocation":192},"/jobs/","jobs",{"dataGaName":474},{"text":437,"config":477},{"href":439,"dataGaName":440,"dataGaLocation":192},{"text":479,"config":480},"Leadership",{"href":481,"dataGaName":482,"dataGaLocation":192},"/company/team/e-group/","leadership",{"text":484,"config":485},"Handbook",{"href":486,"dataGaName":487,"dataGaLocation":192},"https://handbook.gitlab.com/","handbook",{"text":489,"config":490},"Investor relations",{"href":491,"dataGaName":492,"dataGaLocation":192},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":494,"config":495},"Trust Center",{"href":496,"dataGaName":497,"dataGaLocation":192},"/security/","trust center",{"text":499,"config":500},"AI Transparency Center",{"href":501,"dataGaName":502,"dataGaLocation":192},"/ai-transparency-center/","ai transparency center",{"text":504,"config":505},"Newsletter",{"href":506,"dataGaName":507,"dataGaLocation":192},"/company/contact/#contact-forms","newsletter",{"text":509,"config":510},"Press",{"href":511,"dataGaName":512,"dataGaLocation":192},"/press/","press",{"text":514,"config":515,"menu":516},"Contact us",{"dataNavLevelOne":460},{"type":243,"columns":517},[518],{"items":519},[520,525,530],{"text":521,"config":522},"Talk to sales",{"href":523,"dataGaName":524,"dataGaLocation":192},"/sales/","talk to sales",{"text":526,"config":527},"Support portal",{"href":528,"dataGaName":529,"dataGaLocation":192},"https://support.gitlab.com/hc/en-us","support portal",{"text":531,"config":532},"Customer portal",{"href":533,"dataGaName":534,"dataGaLocation":192},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":536,"login":537,"suggestions":544},"Close",{"text":538,"link":539},"To search repositories and projects, login to",{"text":540,"config":541},"gitlab.com",{"href":206,"dataGaName":542,"dataGaLocation":543},"search login","search",{"text":545,"default":546},"Suggestions",[547,549,553,555,559,563],{"text":223,"config":548},{"href":228,"dataGaName":223,"dataGaLocation":543},{"text":550,"config":551},"Code Suggestions (AI)",{"href":552,"dataGaName":550,"dataGaLocation":543},"/solutions/code-suggestions/",{"text":259,"config":554},{"href":261,"dataGaName":259,"dataGaLocation":543},{"text":556,"config":557},"GitLab on AWS",{"href":558,"dataGaName":556,"dataGaLocation":543},"/partners/technology-partners/aws/",{"text":560,"config":561},"GitLab on Google Cloud",{"href":562,"dataGaName":560,"dataGaLocation":543},"/partners/technology-partners/google-cloud-platform/",{"text":564,"config":565},"Why GitLab?",{"href":236,"dataGaName":564,"dataGaLocation":543},{"freeTrial":567,"mobileIcon":572,"desktopIcon":577,"secondaryButton":580},{"text":568,"config":569},"Start free trial",{"href":570,"dataGaName":197,"dataGaLocation":571},"https://gitlab.com/-/trials/new/","nav",{"altText":573,"config":574},"Gitlab Icon",{"src":575,"dataGaName":576,"dataGaLocation":571},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":573,"config":578},{"src":579,"dataGaName":576,"dataGaLocation":571},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":581,"config":582},"Get Started",{"href":583,"dataGaName":584,"dataGaLocation":571},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":586,"mobileIcon":590,"desktopIcon":592},{"text":587,"config":588},"Learn more about GitLab Duo",{"href":228,"dataGaName":589,"dataGaLocation":571},"gitlab duo",{"altText":573,"config":591},{"src":575,"dataGaName":576,"dataGaLocation":571},{"altText":573,"config":593},{"src":579,"dataGaName":576,"dataGaLocation":571},{"button":595,"mobileIcon":600,"desktopIcon":602},{"text":596,"config":597},"/switch",{"href":598,"dataGaName":599,"dataGaLocation":571},"#contact","switch",{"altText":573,"config":601},{"src":575,"dataGaName":576,"dataGaLocation":571},{"altText":573,"config":603},{"src":604,"dataGaName":576,"dataGaLocation":571},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":606,"mobileIcon":611,"desktopIcon":613},{"text":607,"config":608},"Back to pricing",{"href":341,"dataGaName":609,"dataGaLocation":571,"icon":610},"back to pricing","GoBack",{"altText":573,"config":612},{"src":575,"dataGaName":576,"dataGaLocation":571},{"altText":573,"config":614},{"src":579,"dataGaName":576,"dataGaLocation":571},{"title":616,"titleMobile":617,"button":618,"config":623},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":234,"config":619},{"href":620,"dataGaName":621,"dataGaLocation":622},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":624,"disabled":171},"release",{"data":626},{"text":627,"source":628,"edit":634,"contribute":639,"config":644,"items":649,"minimal":859},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":629,"config":630},"View page source",{"href":631,"dataGaName":632,"dataGaLocation":633},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":635,"config":636},"Edit this page",{"href":637,"dataGaName":638,"dataGaLocation":633},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":640,"config":641},"Please contribute",{"href":642,"dataGaName":643,"dataGaLocation":633},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":645,"facebook":646,"youtube":647,"linkedin":648},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[650,697,751,795,827],{"title":339,"links":651,"subMenu":666},[652,656,661],{"text":653,"config":654},"View plans",{"href":341,"dataGaName":655,"dataGaLocation":633},"view plans",{"text":657,"config":658},"Why Premium?",{"href":659,"dataGaName":660,"dataGaLocation":633},"/pricing/premium/","why premium",{"text":662,"config":663},"Why Ultimate?",{"href":664,"dataGaName":665,"dataGaLocation":633},"/pricing/ultimate/","why ultimate",[667],{"title":668,"links":669},"Contact Us",[670,673,675,677,682,687,692],{"text":671,"config":672},"Contact sales",{"href":523,"dataGaName":202,"dataGaLocation":633},{"text":526,"config":674},{"href":528,"dataGaName":529,"dataGaLocation":633},{"text":531,"config":676},{"href":533,"dataGaName":534,"dataGaLocation":633},{"text":678,"config":679},"Status",{"href":680,"dataGaName":681,"dataGaLocation":633},"https://status.gitlab.com/","status",{"text":683,"config":684},"Terms of use",{"href":685,"dataGaName":686,"dataGaLocation":633},"/terms/","terms of use",{"text":688,"config":689},"Privacy statement",{"href":690,"dataGaName":691,"dataGaLocation":633},"/privacy/","privacy statement",{"text":693,"config":694},"Cookie preferences",{"dataGaName":695,"dataGaLocation":633,"id":696,"isOneTrustButton":174},"cookie preferences","ot-sdk-btn",{"title":239,"links":698,"subMenu":707},[699,703],{"text":700,"config":701},"DevSecOps platform",{"href":221,"dataGaName":702,"dataGaLocation":633},"devsecops platform",{"text":704,"config":705},"AI-Assisted Development",{"href":228,"dataGaName":706,"dataGaLocation":633},"ai-assisted development",[708],{"title":709,"links":710},"Topics",[711,716,721,726,731,736,741,746],{"text":712,"config":713},"CICD",{"href":714,"dataGaName":715,"dataGaLocation":633},"/topics/ci-cd/","cicd",{"text":717,"config":718},"GitOps",{"href":719,"dataGaName":720,"dataGaLocation":633},"/topics/gitops/","gitops",{"text":722,"config":723},"DevOps",{"href":724,"dataGaName":725,"dataGaLocation":633},"/topics/devops/","devops",{"text":727,"config":728},"Version Control",{"href":729,"dataGaName":730,"dataGaLocation":633},"/topics/version-control/","version control",{"text":732,"config":733},"DevSecOps",{"href":734,"dataGaName":735,"dataGaLocation":633},"/topics/devsecops/","devsecops",{"text":737,"config":738},"Cloud Native",{"href":739,"dataGaName":740,"dataGaLocation":633},"/topics/cloud-native/","cloud native",{"text":742,"config":743},"AI for Coding",{"href":744,"dataGaName":745,"dataGaLocation":633},"/topics/devops/ai-for-coding/","ai for coding",{"text":747,"config":748},"Agentic AI",{"href":749,"dataGaName":750,"dataGaLocation":633},"/topics/agentic-ai/","agentic ai",{"title":752,"links":753},"Solutions",[754,756,758,763,767,770,774,777,779,782,785,790],{"text":283,"config":755},{"href":278,"dataGaName":283,"dataGaLocation":633},{"text":272,"config":757},{"href":255,"dataGaName":256,"dataGaLocation":633},{"text":759,"config":760},"Agile development",{"href":761,"dataGaName":762,"dataGaLocation":633},"/solutions/agile-delivery/","agile delivery",{"text":764,"config":765},"SCM",{"href":268,"dataGaName":766,"dataGaLocation":633},"source code management",{"text":712,"config":768},{"href":261,"dataGaName":769,"dataGaLocation":633},"continuous integration & delivery",{"text":771,"config":772},"Value stream management",{"href":311,"dataGaName":773,"dataGaLocation":633},"value stream management",{"text":717,"config":775},{"href":776,"dataGaName":720,"dataGaLocation":633},"/solutions/gitops/",{"text":321,"config":778},{"href":324,"dataGaName":325,"dataGaLocation":633},{"text":780,"config":781},"Small business",{"href":330,"dataGaName":331,"dataGaLocation":633},{"text":783,"config":784},"Public sector",{"href":336,"dataGaName":337,"dataGaLocation":633},{"text":786,"config":787},"Education",{"href":788,"dataGaName":789,"dataGaLocation":633},"/solutions/education/","education",{"text":791,"config":792},"Financial services",{"href":793,"dataGaName":794,"dataGaLocation":633},"/solutions/finance/","financial services",{"title":344,"links":796},[797,799,801,803,806,808,811,813,815,817,819,821,823,825],{"text":357,"config":798},{"href":359,"dataGaName":360,"dataGaLocation":633},{"text":362,"config":800},{"href":364,"dataGaName":365,"dataGaLocation":633},{"text":367,"config":802},{"href":369,"dataGaName":370,"dataGaLocation":633},{"text":372,"config":804},{"href":374,"dataGaName":805,"dataGaLocation":633},"docs",{"text":395,"config":807},{"href":397,"dataGaName":398,"dataGaLocation":633},{"text":809,"config":810},"What's new",{"href":455,"dataGaName":456,"dataGaLocation":633},{"text":390,"config":812},{"href":392,"dataGaName":393,"dataGaLocation":633},{"text":409,"config":814},{"href":411,"dataGaName":412,"dataGaLocation":633},{"text":417,"config":816},{"href":419,"dataGaName":420,"dataGaLocation":633},{"text":422,"config":818},{"href":424,"dataGaName":425,"dataGaLocation":633},{"text":427,"config":820},{"href":429,"dataGaName":430,"dataGaLocation":633},{"text":432,"config":822},{"href":434,"dataGaName":435,"dataGaLocation":633},{"text":437,"config":824},{"href":439,"dataGaName":440,"dataGaLocation":633},{"text":442,"config":826},{"href":444,"dataGaName":445,"dataGaLocation":633},{"title":458,"links":828},[829,831,833,835,837,839,843,848,850,852,854],{"text":466,"config":830},{"href":468,"dataGaName":460,"dataGaLocation":633},{"text":471,"config":832},{"href":473,"dataGaName":474,"dataGaLocation":633},{"text":479,"config":834},{"href":481,"dataGaName":482,"dataGaLocation":633},{"text":484,"config":836},{"href":486,"dataGaName":487,"dataGaLocation":633},{"text":489,"config":838},{"href":491,"dataGaName":492,"dataGaLocation":633},{"text":840,"config":841},"Sustainability",{"href":842,"dataGaName":840,"dataGaLocation":633},"/sustainability/",{"text":844,"config":845},"Diversity, inclusion and belonging (DIB)",{"href":846,"dataGaName":847,"dataGaLocation":633},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":494,"config":849},{"href":496,"dataGaName":497,"dataGaLocation":633},{"text":504,"config":851},{"href":506,"dataGaName":507,"dataGaLocation":633},{"text":509,"config":853},{"href":511,"dataGaName":512,"dataGaLocation":633},{"text":855,"config":856},"Modern Slavery Transparency Statement",{"href":857,"dataGaName":858,"dataGaLocation":633},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":860},[861,864,867],{"text":862,"config":863},"Terms",{"href":685,"dataGaName":686,"dataGaLocation":633},{"text":865,"config":866},"Cookies",{"dataGaName":695,"dataGaLocation":633,"id":696,"isOneTrustButton":174},{"text":868,"config":869},"Privacy",{"href":690,"dataGaName":691,"dataGaLocation":633},[871],{"id":872,"title":7,"body":170,"config":873,"content":875,"description":170,"extension":879,"meta":880,"navigation":174,"path":881,"seo":882,"stem":883,"__hash__":884},"blogAuthors/en-us/blog/authors/jeff-burrows.yml",{"template":874},"BlogAuthor",{"name":7,"config":876},{"headshot":877,"ctfId":878},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749680588/Blog/Author%20Headshots/jburrows001-headshot.jpg","jburrows001","yml",{},"/en-us/blog/authors/jeff-burrows",{},"en-us/blog/authors/jeff-burrows","au4O9DNpoWXnlHxrNn7X6SqZcCorAiyEp2RRKdbbF5g",[886,894,902],{"title":887,"description":888,"heroImage":889,"category":166,"date":890,"authors":891,"slug":893,"externalUrl":170},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[892],"Julian Thome","improved-scope-offset-fingerprinting",{"title":895,"description":896,"heroImage":889,"category":166,"date":897,"authors":898,"slug":901,"externalUrl":170},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[899,900],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":903,"description":904,"heroImage":905,"category":166,"date":906,"authors":907,"slug":909,"externalUrl":170},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[908],"Alisa Ho","claude-security-and-gitlab",{"promotions":911},[912,926,938,949],{"id":913,"categories":914,"header":916,"text":917,"button":918,"image":923},"ai-modernization",[915],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":919,"config":920},"Get your AI maturity score",{"href":921,"dataGaName":922,"dataGaLocation":398},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":924},{"src":925},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":927,"categories":928,"header":930,"text":917,"button":931,"image":935},"devops-modernization",[929,735],"product","Are you just managing tools or shipping innovation?",{"text":932,"config":933},"Get your DevOps maturity score",{"href":934,"dataGaName":922,"dataGaLocation":398},"/assessments/devops-modernization-assessment/",{"config":936},{"src":937},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":939,"categories":940,"header":941,"text":917,"button":942,"image":946},"security-modernization",[166],"Are you trading speed for security?",{"text":943,"config":944},"Get your security maturity score",{"href":945,"dataGaName":922,"dataGaLocation":398},"/assessments/security-modernization-assessment/",{"config":947},{"src":948},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":950,"paths":951,"header":954,"text":955,"button":956,"image":961},"github-azure-migration",[952,953],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":957,"config":958},"See how GitLab compares to GitHub",{"href":959,"dataGaName":960,"dataGaLocation":398},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":962},{"src":937},{"header":964,"blurb":965,"button":966,"secondaryButton":971},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":967,"config":968},"Get your free trial",{"href":969,"dataGaName":197,"dataGaLocation":970},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":671,"config":972},{"href":523,"dataGaName":202,"dataGaLocation":970},1786803767755]