CI/CD Pipeline Security Tools, Standards, and Best Practices

NIST SP 800-204D csrc.nist.gov DevSecOps strategies for software supply chain security in CI/CD; build integrity, dependency controls, SBOM requirements, attestations, and secure infrastructure deployments throughout the pipeline Federal agencies and contractors; the most specific US government guidance available for CI/CD build and deploy security NIST SSDF SP 800-218 csrc.nist.gov Secure Software Development Framework covering the entire software development life cycle: source code protection, code repositories, third-party components, and the full development process from design through deployment Mandatory under Executive Order 14028 for software vendors supplying the US federal government; baseline for any organization that needs formal SDLC governance SLSA slsa.dev Supply-chain Levels for Software Artifacts; four-level maturity model for build integrity and provenance; higher levels require tamper-resistant build environments and cryptographically signed attestations verifying what was built, when, and by whom Engineering teams hardening CI/CD against supply chain attacks; SLSA Level 2, which uses a hosted build platform with signed provenance, is the practical starting point for most organizations OWASP CI/CD Top 10 owasp.org Ten most critical CI/CD security risks with specific mitigations per pipeline stage; covers insufficient flow control mechanisms, poisoned pipeline execution, improper artifact integrity validation, and insufficient access controls Development and operations teams; maps directly to pipeline configuration choices and works as an actionable checklist alongside NIST governance frameworks