NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.2b: Use CI tools only when their source origin is trustworthy

What does 5.1.2b require?

CI pipelines run only with external tools (for example a build orchestrator) whose source-code origin has been established as trustworthy, so that the tooling that handles every change is not itself a supply chain weakness.

Maintained by Gerard Blokdyk

Other controls in Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls