NIST SP 800-204D Software Supply Chain Security in...

What does 3.2.2b require?

The SCM produces data that establishes provenance of changes, such as signed commits, author identity and review records, and the organisation pairs that data with mechanisms to validate and authenticate it and to use it in downstream policy decisions, for example allowing a build only from reviewed, signed commits.

Other controls in Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

3.2.1a Keep every developer and build system to a defined security baseline
3.2.1b Approve open-source intake and prefer source over prebuilt binaries
3.2.1c Verify, scan and inventory newly downloaded open-source packages
3.2.1d Scan stored artifacts for new defects and be able to block their use in builds
3.2.1e Audit CI/CD processes regularly and automate wherever possible
3.2.2a Control write access to source code management and require peer review before merge

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls