Download Publication

Given the rapid evolution of software development paradigms and practices, it has become a challenge to align monolithic security compliance activities with software development. Compliance teams have a vested interest in proving that a process and controls are in place. However, most DevOps aligned engineers believe that the proof should be in the code, not in the process or in its documentation.

This document by the DevSecOps Working Group provides guidance to ensure the gap between compliance and development is addressed by recognizing compliance objectives, translating them to appropriate security measures, and identifying inflection points within the software development lifecycle where these controls can be embedded, automated, measured, and tested in a transparent and easily understood way. 

This publication is part of an entire series on the Six Pillars of DevSecOps. You can find all the papers in the series that have been released so far here.