NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.3b: Keep online signing keys away from roles clients ultimately trust, and guard them when used

What does 5.1.3b require?

Online keys, meaning keys used in an automated fashion, never serve a role that clients end up trusting for the files they install, and where keys are online, exceptional care is taken: they are held in a hardware security module and used only when the artifacts being signed have passed the policy defined for secure build and commit, so that automated signing cannot bless an artifact that failed the pipeline's checks.

Maintained by Gerard Blokdyk

Other controls in Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls