FFIEC IT Examination Handbook DAM-VII.B.2(c): VII.B.2(c) Code Repository Controls (Development, Acquisition, and Maintenance)

Management establishes code repository policies that specify which repositories are used and where their data reside, prohibit public forums and personal accounts for entity business, establish source code ownership, require business accounts and prohibit entity credentials on personal accounts, control and track accounts on authorised cloud repositories, prohibit posting entity code publicly, evaluate repository risks with multifactor authentication, audits, data sanitisation and restrictions on exfiltration to personal accounts, block sensitive data from unapproved repositories with data loss prevention, and search for exposed entity code.