NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.2d: Deploy only artifacts produced by the secure build, with vulnerability scan evidence and policy gating

What does 5.2d require?

Where a secure build environment and process exist, the deploy stage can require that the artifact (for example a container image) being deployed was generated by that secure build, verified through the signed attestations; there is evidence that the image was scanned for vulnerabilities, with attestation of the scan, and deployment can be allowed or blocked according to organisation-defined policies applied to that evidence.

Maintained by Gerard Blokdyk

Other controls in Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls