NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
Sections 5.3, 6 and Appendix A: Implementation strategy, summary and SSDF mapping – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines

NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.3: Implementation strategy for SSC security in the pipeline

What does 5.3 require?

An organisation's implementation strategy combines four approaches: solutions that provide supply chain security through features attached to each pipeline task, such as the requirements in sections 5.1 and 5.2; solutions that establish integrity and provenance by way of digital signatures and attestations; a strategy to keep running code current, such as a build horizon under which code older than a set period is not launched so that production stays close to the latest verified build; and securing the CI/CD clients so that malicious code cannot steal confidential data or credentials from them.

Maintained by Gerard Blokdyk

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines controls