Technology General Controls (ITGC)
Description
The entity selects and develops general control activities over technology — including access controls, change management, system operations, and segregation of duties — to support the achievement of security objectives.
⚠️ Risk Impact
ITGC failures cascade into application-level failures that are difficult to detect at the application layer. When the underlying platform's change management is undisciplined, application-level controls inherit the chaos.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Document the ITGC stack: cloud account management, CI/CD policy, IaC review gates, secret management, IAM hygiene. Apply policy-as-code (Kyverno, OPA, AWS Config) to enforce. Quarterly ITGC review tests evidence of operation.
💀 Real-World Attack Scenario
A company's application-level access controls were rigorous but the underlying CI/CD allowed any engineer to deploy any service via shared service-account credentials. When an engineer's laptop was compromised, the attacker used the CI/CD credentials to deploy a malicious sidecar to a production payment service. The application-level controls couldn't detect the malicious sidecar because the deployment 'came through legitimate CI/CD'. ITGC weakness ($1.4M direct loss + qualified SOC 2 opinion).
💰 Cost of Non-Compliance
ITGC weaknesses as breach contributor: 53% of cloud breaches in 2024 (Mandiant M-Trends). Average breach cost when ITGC is weak: 2.7× higher than when ITGC is strong.
📋 Audit Questions
- 1.Show me the ITGC matrix.
- 2.How are CI/CD service accounts scoped and rotated?
- 3.What is the IaC review process for production changes?
- 4.Show me a case where the ITGC blocked a non-compliant change.
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Application security strong but CI/CD wide open — attackers bypass the application layer entirely
- ⛔IaC policy-as-code documented but not enforced (audit/log mode only)
- ⛔Service accounts in CI/CD shared across teams or environments
📈 Business Value
Robust ITGC is the unglamorous foundation that makes application security real. Companies with strong ITGC have measurably lower breach rates and shorter MTTR — and qualify for cyber-insurance terms that exclude under-controlled organizations.
⏱️ Effort Estimate
60-120 hours for comprehensive ITGC documentation + policy-as-code rollout
EchelonGraph evaluates ITGC continuously; flags drift from approved baseline
🔗 Cross-Framework References
Automate SOC 2 CC5.2 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →