N.6.08 Procedures and measures for deploying software
Control Overview
This control mandates that organizations establish, document, and enforce structured procedures and technical measures to ensure that software and system configurations are deployed to live production environments in a secure, controlled, and repeatable manner. To prevent unauthorized modifications or configurations that could destabilize systems or compromise data, deployment pipelines must utilize modern validation gates. These gates should incorporate automated testing, Infrastructure as Code (IaC) architectures, explicit operational approval loops, and comprehensive post-implementation logging to maintain end-to-end traceability.
Applicability Note: This control is fully applicable to the anDREa platform and serves as the operational mechanism governing how software updates, system patches, and configuration modifications are pushed to the live myDRE service plane.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, moving away from manual infrastructure modifications by standardizing on a fully automated, state-enforced deployment model.
anDREa eliminates the risks associated with manual "ad-hoc" modifications by codifying both system code and cloud environment topologies:
- Infrastructure as Code (IaC): Platform resources, virtual environments, firewall configurations, and routing matrices are written as code templates. This guarantees that all hosting layers within Microsoft Azure are provisioned identically across our environmental rings, eliminating configuration drift and human error.
- Pipeline Orchestration: Software rollouts follow a rigid, linear release lifecycle. Code increments are packaged, verified, and pushed systematically using secure CI/CD pipelines (such as GitHub Actions).
[Pull Request / Code Review] ──> [Automated Build & Test] ──> [IaC Validation Gate] ──> [Product Owner Approval] ──> [Automated Pipeline Rollout]
- Formal Release Gates: A rollout cannot reach production autonomously. Pipelines enforce an un-bypassable "Release Gate" requiring formal sign-off from the Product Owner or an authorized delegate, backed by verification from previous automated static analysis runs.
- Emergency Hotfixes: If an urgent patch must be applied outside standard timelines, the deployment is treated with heightened security oversight under our incident-response framework. This requires an immediate post-implementation review and a root-cause analysis (RCA) to log any technical side effects.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.08.32 - Change management | Mandates that the execution of software deployments and infrastructure changes follows formalized, traceable configuration control steps. |
| ISO/IEC 27001 | A.08.09 - Configuration management | Mandates that templates, parameters, and system baselines are defined, managed, and enforced (realized through IaC). |
| ISO/IEC 27001 | A.05.37 - Documented operating procedures | Requires operational runbooks and deployment workflows to be formally written down and standardized. |
| Infrastructure Records | IaC Repository & ARM/Bicep Templates | Declarative cloud resource configurations proving that system components are derived from auditable, version-controlled files. |
| Pipeline Telemetry | CI/CD Execution & Deployment Logs | Complete, tamper-resistant automated execution logs showing build passes, test outcomes, approval records, and release versions. |
| Governance Records | Post-Implementation Review Logs (PIR) | Documentation capturing the formal security review, approval trail, and outcome analysis for major or emergency system changes. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Immutable Infrastructure as Code frameworks, automated multi-gate delivery pipelines, mandatory Product Owner authorization controls, and auditable deployment trails are completely operationalized.