What does 3.2.1e require?

CI/CD processes are audited at regular intervals against the organisation's policy, and automation is introduced wherever it can replace manual steps, because manual operations are where errors and unauthorised changes enter and where auditability is lost.

NIST SP 800-204D Software Supply Chain Security in...

Other controls in Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

3.2.1a Keep every developer and build system to a defined security baseline
3.2.1b Approve open-source intake and prefer source over prebuilt binaries
3.2.1c Verify, scan and inventory newly downloaded open-source packages
3.2.1d Scan stored artifacts for new defects and be able to block their use in builds
3.2.2a Control write access to source code management and require peer review before merge
3.2.2b Generate and use SCM provenance data in policy decisions

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls