NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.3a: Protect software update integrity against known attacks with multi-key, threshold trust

What does 5.1.3a require?

The framework used to protect the integrity of evidence during software updates guards against all known attacks on update tasks, (generating metadata and hashes, signing, looking after the signing keys, distributing the update), and it contains the damage from a compromised key by giving roles several keys with threshold or quorum trust (except for roles designed to be minimally trusted), so that compromise of a role using a highly exposed key has minimal effect. The framework is flexible enough for a wide range of update systems and easy to integrate with them.

Maintained by Gerard Blokdyk

Other controls in Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls