NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 3.2.1b: Approve open-source intake and prefer source over prebuilt binaries

What does 3.2.1b require?

The security team approves the merging of open-source software from sources that have not been verified, and developers download open-source components in source form rather than as ready-built libraries or binaries wherever source can be had, so that what enters the build can be inspected and built under the organisation's own controls.

Maintained by Gerard Blokdyk

Other controls in Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls