Choose controls for your risk profile
Choose the closest profile for each workload, then use it to prioritize controls in the Security checklist. Consider the code it accepts, the credentials and systems it can access, and the impact of compromise on confidentiality, integrity, and availability. For example, a pipeline that runs untrusted pull requests needs strong isolation even if it doesn't deploy to production.
The following profiles are starting points, not security ratings, compliance certifications, or a formal Buildkite security standard. Your organization's security and compliance requirements determine which controls apply.
Compare workload profiles
| Workload profile | Example workload and impact | Start here | |||
|---|---|---|---|---|---|
| Workload profile | Limited impact | Example workload and impact | Tests that use non-sensitive data, have no production access, and don't publish artifacts consumed by production. A failed or compromised build has a contained impact. | Start here | Review the baseline controls in every area. Prioritize account protection, isolation from sensitive workloads, and restricted credentials. Mark deployment-specific controls as not applicable only after checking that the workload has no path to production. |
| Workload profile | Production delivery | Example workload and impact | Builds that publish packages or deploy services. Compromise could alter a release, expose credentials, or interrupt a service. | Start here | Complete Secure your first production pipeline, then apply the relevant baseline and recommended controls. Prioritize secrets management, pipeline and supply chain integrity, and monitoring and detection. |
| Workload profile | High consequence | Example workload and impact | Workloads that access regulated or highly sensitive data, sign releases, or deploy critical services. Compromise could cause widespread or lasting harm. | Start here | Start with the production delivery controls, then assess advanced controls with your security team. Prioritize agent isolation, independent verification of releases, restricted network access, and tested incident response. |
Turn the profile into a plan
The checklist groups controls into three tiers: Baseline covers foundational protections, Recommended adds protections for production delivery, and Advanced covers specialized threats and higher-consequence workloads. Choose the controls that apply to your workload, hosting model, and plan, rather than trying to complete every item.
- Review the baseline in each checklist area and use its completion criteria to verify your setup.
- Add recommended and advanced controls according to the workload profile and your organization's requirements.
- Record outstanding controls, owners, and review dates in your own tracking system. For controls that don't apply, record why.