NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.2.1b: GitOps: no manual runtime changes, and detect and remediate drift

What does 5.2.1b require?

Changes are not applied manually at runtime with cluster tools; instead the relevant code is changed and a new release that incorporates the change is triggered. Because the repository holds the application definitions and configuration in code form, it is pulled automatically and compared with the deployed state at regular intervals; notifications are sent on differences and manual remediation is performed.

Maintained by Gerard Blokdyk

Other controls in Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls