NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.4b: Enumerate and evaluate all dependencies, including transitive ones

What does 5.1.4b require?

Where open-source modules and libraries are brought in, every dependency is listed, understood and judged against policy, using software composition analysis tools where appropriate, and the security conditions a dependency must meet for inclusion are tested. Dependency detectors find all dependencies, including transitive ones, preferably with no limit on the depth of nesting analysed.

Maintained by Gerard Blokdyk

Other controls in Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls