Protect code and access keys
Short label: CODE
Meaning
Control where project code is kept, who can change it and how passwords or access keys are detected.
Why it matters
A copied project can expose both intellectual property and credentials that enable access to another service.
What you can do
Use company repositories, review access and run credential checks. If a key is exposed, revoke it and investigate its use.
Services that can help
Sovereign Code provides agreed hosting, access rules and scanning steps. Its project inventory helps identify who owns the code and where it belongs.
Official reference — NIS2 Art. 21(2)(i)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(i) human resources security, access control policies and asset management;
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(i)
People and access: who may access what, how accounts are given and taken away, and an inventory of what you own.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.