NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
NIST's strategies for integrating software supply chain security into DevSecOps CI/CD pipelines: environment baselines, open-source intake, SCM controls, pipeline trust and attestations, secure build, commit and deploy requirements, GitOps practice and update-key protection.
NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines is a compliance framework from United States with 5 domains and 28 controls. The largest domains are Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines (11 controls), Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines (7 controls), Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines (7 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
| Code | Title |
|---|---|
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.1a | Keep every developer and build system to a defined security baseline |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.1b | Approve open-source intake and prefer source over prebuilt binaries |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.1c | Verify, scan and inventory newly downloaded open-source packages |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.1d | Scan stored artifacts for new defects and be able to block their use in builds |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.1e | Audit CI/CD processes regularly and automate wherever possible |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.2a | Control write access to source code management and require peer review before merge |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::3.2.2b | Generate and use SCM provenance data in policy decisions |
Section 4: CI/CD pipeline security goals and entities to be trusted – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
| Code | Title |
|---|---|
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::4.1a | Establish and verify trust in every entity, artifact and repository in the pipeline |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::4.1b | Re-establish trust at every handoff and verify each build step's inputs and outputs |
Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
| Code | Title |
|---|---|
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.1a | Build on a hardened, isolated platform and gather evidence of isolation |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.1b | Produce environment, process, materials and artifact attestations for each build |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.1c | Sign attestations with a secure key and store them tamper-proof |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.2a | Run automated checks on every pushed change and tie requests to the developer's role |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.2b | Use CI tools only when their source origin is trustworthy |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.2c | Hold outside contributors' workflow runs until a maintainer approves |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.3a | Protect software update integrity against known attacks with multi-key, threshold trust |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.3b | Keep online signing keys away from roles clients ultimately trust, and guard them when used |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.4a | Run static and dynamic security testing on every language before commits are accepted |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.4b | Enumerate and evaluate all dependencies, including transitive ones |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.1.4c | Check committed code for policy adherence and secrets, and enable push protection |
Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
| Code | Title |
|---|---|
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2.1a | GitOps: rely on automation and preserve all release data |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2.1b | GitOps: no manual runtime changes, and detect and remediate drift |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2a | Scan containers at build and integrate registry tooling with an automated pipeline |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2b | Scan deploy-ready code and repositories for secrets |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2c | Review dependency vulnerabilities before pull requests are merged |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2d | Deploy only artifacts produced by the secure build, with vulnerability scan evidence and policy gating |
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.2e | Check release build scripts periodically for malicious code |
Sections 5.3, 6 and Appendix A: Implementation strategy, summary and SSDF mapping – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines
| Code | Title |
|---|---|
| nist-sp-800-204d-software-supply-chain-security-in-devsecops-ci-cd-pipelines::5.3 | Implementation strategy for SSC security in the pipeline |
What is NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines and who does it apply to?
NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines is a compliance framework from United States with 5 domains and 28 controls. NIST's strategies for integrating software supply chain security into DevSecOps CI/CD pipelines: environment baselines, open-source intake, SCM controls, pipeline trust and attestations, secure build, commit and deploy requirements, GitOps practice and update-key protection. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines actually require?
NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines has 28 controls organised across 5 domains. The largest domains are Section 5.1: Securing workflows in CI pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines (11 controls), Section 3: Software supply chain risk factors and mitigation measures – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines (7 controls), Section 5.2: Securing workflows in CD pipelines – NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines do I already cover?
NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines?
Start your NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required