NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.2c: Hold outside contributors' workflow runs until a maintainer approves

What does 5.1.2c require?

The repository or SCM system has built-in protection that either runs CI workflows for outside contributions in a sandbox with no network access, privileged access or secrets, or delays the workflow run until a maintainer approves it; the protection takes effect for pull requests that outside contributors open against a public repository, and is set at the strictest level, such as requiring approval for all outside collaborators. Where the SCM offers no such protection, external security tools with equivalent functions (evaluating the contribution and gating the run) are required.

Maintained by Gerard Blokdyk

Other controls in Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls