What it covers. NIST publication on security strategies for applications built from microservices, covering authentication, access management, service discovery, secure communication, monitoring and resilience. Later publications in the 800-204 series address service mesh deployments, attribute-based access control, DevSecOps for cloud-native applications and software supply chain security in CI/CD pipelines.
In practice. Applying it well means securing communication between services, typically with mutual TLS, enforcing fine-grained authorisation per service, protecting API gateways and building security checks into automated pipelines. Pipelines themselves are treated as critical systems, with protected credentials and verified artefacts. Evidence includes architecture records, pipeline configuration and monitoring of service traffic.
Common gaps. Common gaps are unauthenticated internal service traffic, secrets stored in pipeline configuration and inconsistent policy across services.