Integration of SHIP-HATS with GCC+ (Upcoming)

SHIP-HATS is set to integrate with GCC+ in 2025, enabling agencies to host and manage confidential projects securely.

Prerequisites

SHIP-HATS only supports data classified as Confidential Cloud Eligible (CCE) or below. For projects involving data classified as Confidential or above, ensure correct classification of your source code by following the Right-Classification-Guide-for-System-Owners-Jul-2024.pdf, which is accessible only via a GSIB device.

While adherence to IM8 policies is a default requirement, to ensure you’re fully equipped for this, we have provided some guidelines. To prepare, review these guidelines and stay tuned for updates on the integration timeline and necessary actions.

Key practices for confidential projects hosted on GCC+

• Use SHIP-HATS PLZ-hosted GCC+ runners
  SHIP-HATS will offer PLZ-hosted GCC+ runners, specifically designed for secure and compliant CI/CD processes within the GCC+ environment. You need to integrate these runners into your projects to leverage their enhanced security features and centralised management capabilities.

• Nexus repository for artefact management
  We strongly encourage you to use the Nexus Repository for artefact downloads. By this, you can ensure the secure, efficient, and centralised management of software components. Learn more about Upload and organise artefacts.

• Security scanning Security scanning is a basic requirement of IM8. We emphasise that regular scanning allows you to proactively identify and address potential vulnerabilities. By doing so, you can significantly reduce the risk of security breaches, data leaks, and other cybersecurity incidents that could compromise your systems.

• SHIP-HATS templates
  We strongly recommend the usage of SHIP-HATS templates. Thus you can ensure consistency in project structures, configurations, and workflows across the organisation. These templates are aligned with our best practices, helping to reduce errors and prevent misconfigurations that could lead to security vulnerabilities or operational issues. Refer to SHIP-HATS Templates.

• Least privilege access controls
  To protect your codebase and sensitive information, it is essential that you enforce access controls on GitLab repositories based on the principle of least privilege. This means granting users only the minimum level of access required to perform their job functions. Regular audits and reviews of access levels should be conducted by your agency to ensure that permissions remain appropriate and secure.

• Submit signed AUP
  Before hosting your SHIP-HATS projects on GCC+, you may need to carefully read and sign the Acceptable Use Policy (AUP). This document outlines the terms and conditions of hosting on GCC+ and serves as your acknowledgement of the support limitations and security requirements. It is crucial to understand and agree to these terms to ensure compliance and secure operation within the GCC+ environment.