NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 3.2.2a: Control write access to source code management and require peer review before merge

What does 3.2.2a require?

Write access to the source code management (SCM) system is treated as high risk and tightly controlled; proposed changes follow the organisation's defined SDLC process; and in a mature process developers propose patches which a different developer reviews before merging. Code analysis tools catch common mistakes, tuned so that false positives do not flood developers and cause alert fatigue.

Maintained by Gerard Blokdyk

Other controls in Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls