The Six Pillars of DevSecOps: Bridging Compliance and Development
Released: 02/08/2022
Given the rapid evolution of software development paradigms and practices, it has become a challenge to align monolithic security compliance activities with software development. Compliance teams have a vested interest in proving that a process and controls are in place. However, most DevOps aligned engineers believe that the proof should be in the code, not in the process or in its documentation.
This document by the DevSecOps Working Group provides guidance to ensure the gap between compliance and development is addressed by recognizing compliance objectives, translating them to appropriate security measures, and identifying inflection points within the software development lifecycle where these controls can be embedded, automated, measured, and tested in a transparent and easily understood way.
Key Takeaways:
- How to conduct assessments, which are the first port of call for gauging maturity and effectiveness in DevSecOps processes
- Key considerations for shifting the mindset of how to design and implement compliance into applications
- How to translate compliance objectives into security measures
- The different practices in security tooling that can provide assurance for compliance requirements
- How to implement guardrails
This publication is part of an entire series on the Six Pillars of DevSecOps. You can find all the papers in the series that have been released so far here.
Topics:
Prefer to access this resource without an account? Download it now.
Best For:
- CISOs
- DevOps Professionals
- Quality Assurance Specialists
- Internal Auditors
