Address OWASP Top 10 A08 Software and Data Integrity Failures per OWASP Top 10:2025. Software and Data Integrity Failures arise from assumptions about software updates + critical data + CI/CD pipelines without verifying integrity including unsigned updates + insecure deserialisation + third-party script + tag injection + plugin compromise + supply chain attacks. Mitigations include (a) implement code signing + signature verification for software updates + plugins + (b) implement secure CI/CD pipeline including signed artefacts + isolated build environments + integrity verification + (c) implement Subresource Integrity (SRI) for third-party scripts + (d) implement secure deserialisation including allow-list of accepted types + (e) implement third-party script + tag management with monitoring + (f) protect against supply chain attacks via dependency confusion + typosquatting + repository compromise.
This control maps to 11 controls across 8 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 11 it maps to, and the evidence behind each claim, over MCP and REST.