NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 4: CI/CD pipeline security goals and entities to be trusted – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 4.1a: Establish and verify trust in every entity, artifact and repository in the pipeline

What does 4.1a require?

The scope of trust in a CI/CD pipeline is wide, so the entities that perform supply chain activities (building, packaging, signing, deploying) are authenticated and authorised, and the integrity of artifacts and of the repositories that hold them is checked by verifying their digital signatures. Other assurance artifacts the pipeline relies on, such as SBOMs, vulnerability reports and model registries holding AI models, are trusted on the same basis.

Maintained by Gerard Blokdyk

Other controls in Section 4: CI/CD pipeline security goals and entities to be trusted – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls