NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.1c: Sign attestations with a secure key and store them tamper-proof

What does 5.1.1c require?

Signed evidence (attestations) is cryptographically signed using a secure key, and the storage location for attestations is tamper-proof and protected with robust access control, so that consumers of the evidence, including the deploy stage, can rely on it.

Maintained by Gerard Blokdyk

Other controls in Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls