NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 3.2.1c: Verify, scan and inventory newly downloaded open-source packages

What does 3.2.1c require?

On each newly downloaded open-source source package, developers verify its digital signature, run a vulnerability scan, check whether it has been updated recently (an abandoned project is a risk), and produce an SBOM, with its dependencies scanned, at the first build in which it appears, so that the component and everything it pulls in is known before it is relied on.

Maintained by Gerard Blokdyk

Other controls in Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls