What it asks for. This category, new in 2021, covers code and infrastructure that do not protect against integrity violations. Examples include relying on plugins, libraries or updates from untrusted sources, insecure CI/CD pipelines, automatic updates without integrity verification and insecure deserialisation of untrusted data, which was merged into this category.
In practice. Organisations verify signatures or hashes on software and updates, use trusted and pinned dependency sources, protect build pipelines with access control, separation and review, and avoid deserialising untrusted data or verify its integrity first. Evidence includes signing and verification configuration, pipeline access reviews, build provenance and code review records for pipeline changes.
Common gaps. Pipelines are often less protected than production, with broad credentials and unreviewed changes. Updates and artefacts are frequently signed but never verified when consumed.