Australian Information Security Manual ISM-2055: If a software build provenance is available for imported third-party software components,

If a software build provenance is available for imported third-party software components, it is used during software development to ensure such software components are built to an appropriate standard.

Other controls in Guidelines for software development

ISM-0400 Development, testing, staging and production environments are segregated.
ISM-0401 Secure by Design principles and practices are followed throughout the software development
ISM-0402 Software is comprehensively tested for vulnerabilities, using SAST, DAST and SCA prior to
ISM-0971 The OWASP Application Security Verification Standard is used in the development of web app
ISM-1238 Threat modelling is used in support of the software development life cycle.
ISM-1239 Robust web application frameworks are used in the development of web applications.
ISM-1240 Validation and sanitisation are performed on all input received over the internet by softw
ISM-1241 Output encoding is performed on all output produced by web applications.

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls