NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.2c: Review dependency vulnerabilities before pull requests are merged

What does 5.2c require?

Before a pull request is merged it is possible to see the details of any vulnerable dependency versions it introduces or retains, through a form of dependency review, so that the merge decision is made with that information in view.

Maintained by Gerard Blokdyk

Other controls in Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls