How GitLab built a security control framework from scratch

This post details the creation of a custom security control framework (GCF) at GitLab to address the limitations of existing industry frameworks (like NIST SP 800-53) for their multi-product, cloud-native environment. It outlines a five-step process: analyzing needs, learning from industry frameworks, creating custom control domains (18 in total, e.g., IAM, SDL, SRM), adding context and data through a control hierarchy (Level 1 framework, Level 2 product-specific implementation), and iterating for new certifications and regulations. The GCF's superpower is its extensive metadata tracking (owner, environment, assets, frequency, nature, classification, testing details), transforming it into an operationalized control inventory.