# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-IR-001
title: Have a response procedure for compromised dependencies
finding:
  title: There is no plan for when a malicious dependency has been installed
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [incident, secrets]
description: |
  A written procedure covers the case where a malicious or compromised package version was installed anywhere in the organization. It includes at least:

  1. finding every workstation, pipeline and system that installed it (CB-DEP-INV-002);
  2. treating those machines as compromised;
  3. rotating every secret they could reach: registry and source hosting tokens, cloud credentials, SSH and signing keys, environment variables;
  4. checking whether the organization's own packages or repositories were modified or published with stolen credentials;
  5. purging the version from caches and the registry proxy, and pinning a safe version;
  6. recording what happened and what changed.
rationale: |
  Malicious packages typically steal credentials within seconds and use them to spread. The response must be fast and complete, which only happens if it was written before.
impact: |
  The procedure must be exercised and kept current.
audit:
  manual: |
    1. Check that the procedure exists and covers the steps above.
    2. Check that it was exercised in the last year.
remediation:
  manual: |
    1. Write the procedure, starting from the steps above.
    2. Run a tabletop exercise.
references:
  - title: NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    publisher: NIST
    kind: standard
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: IR-4
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: IR-8
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-8
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-INV-002
    type: related
  - id: CB-DEP-VULN-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16