Scorecard checks whether the default and release branches are protected by branch protection or repository rules, scored in five tiers that must be met in order: tier 1 (3/10) blocks force pushes and branch deletion; tier 2 (6/10) requires at least one approving reviewer, pull requests before changes, the branch to be up to date before merging and approval of the most recent push; tier 3 (8/10) requires at least one passing status check; tier 4 (9/10) requires two reviewers and code-owner review; tier 5 (10/10) dismisses stale approvals on new commits and applies the rules to administrators. Settings visible only to an admin token are treated as met when no admin token is used; a bypass actor on any rule counts as administrators not being included.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.