Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Standards and governance in DevSecOps determine whether secure practices are consistent, visible, and enforceable across the organization. Strong governance helps teams protect engineering systems, reduce risk, and apply security requirements without slowing delivery.
This capability area describes how an organization defines, communicates, and enforces its security program, the policies and standards teams work to, and the protections applied to the engineering systems that build and ship software. Governance turns good intentions into repeatable, monitorable practice.
As organizations mature, standards shift from absent or reactive to a universal foundation for daily work. Security and privacy become a priority early in every process, and emerging technologies such as AI are governed more deliberately and strategically.
Core capability areas
Standards and governance in DevSecOps focuses on three sub-capabilities:
Security program: How the organization invests in secure development practices and addresses risk over time.
Policies and standards: How requirements, compliance, and the governance of open source and AI are defined and applied.
Protecting engineering systems: How identity, access, workstations, and build and test environments are secured.
Stages
Standards and governance progress through five stages of maturity. These stages show how DevSecOps principles appear in organizational priorities, from inconsistent adherence to forward-looking governance that goes beyond the fundamentals and helps define industry leadership.
| Overall stage | Stage name | What it looks like |
|---|---|---|
| Ad-hoc | Implicit | A lack of attention and standards makes adherence inconsistent and difficult to monitor. |
| Initiating | Explicit | Fixed processes and standard tooling enable more reliable, consistent activities. |
| Orchestrating | Principled | Established principles make priorities for standards and governance clear. |
| Streamlining | Comprehensive | Standards set a universal foundation, and security and privacy become a priority early in every process. |
| Pioneering | Forward-looking | Value comes from optimizing and using emerging technologies to lead the industry. |
Implicit (Ad-hoc)
Before governance is established, a lack of attention and standards makes adherence inconsistent and difficult to monitor.
Security program: The organization doesn't invest in established patterns, methods, or secure practices. It identifies and addresses critical issues at release or, more often, only when reacting to an incident.
Policies and standards: Limited oversight increases the risk of noncompliance, insecure systems, and incomplete software.
Protecting engineering systems: Engineering systems lack standards and management. Identity orchestration and authentication are minimal, and personal sign-ins are used for SaaS sites.
Explicit (Initiating)
As governance begins to take shape, fixed processes and standard tooling enable more reliable and consistent development activities.
Security program: Teams rely on outside sources for guidance. Limited visibility makes risks hard to identify and mitigate. A milestone-based focus causes debt to accumulate over time, only critical issues are addressed, and security activities remain periodic.
Policies and standards: Compliance management focuses on government regulation at release. Open source and artificial intelligence (AI) use aren't yet covered.
Protecting engineering systems: Some areas are managed and standards begin to emerge in pockets of the organization, including separation of test and production environments. Workstations are physical, centrally managed, and limited to basic local user management. Third-party SaaS still relies on personal sign-ins. Default user groups, roles, and role-based access control (RBAC) are used. Multi-factor authentication (MFA) might be required for admins.
Principled (Orchestrating)
Established principles make priorities for standards and governance clear and guide how DevSecOps practices are rolled out.
Security program: Teams begin following secure development lifecycle principles. Security objectives are defined and communicated, helping teams prevent new issues while planning for legacy ones. Critical and high-impact issues are addressed, and protecting identity and secrets becomes a priority.
Policies and standards: Top-down requirements and paved-path standardization are in place. Open source and AI use are allowed with guidance.
Protecting engineering systems: Build and test processes are defined through paved-path standards, including branch protection, code review, and verification testing. Cloud developer workstations are centrally managed. Access to source code and engineering infrastructure is secured through Zero Trust and least-privilege policies, with role-based access and enterprise identity management. Third-party SaaS uses single sign-on (SSO). Custom user groups and roles are defined and regularly validated, and MFA is encouraged for everyone.
Comprehensive (Streamlining)
Standards set a universal foundation that allows the organization to improve both protections and efficiency. Security and privacy become a priority early in every process.
Security program: Security becomes part of incentives, and specialized activities are built into normal business rhythms. Even medium-severity issues are addressed, and checks block the introduction of new issues. Risk identification and mitigation mature, and agentic AI supports program goals and activities.
Policies and standards: Guardrails blend top-down and bottom-up approaches with real-time reporting and resolution. Open source and AI are governed strategically, and human-in-the-loop (HITL) workflows remain manageable and resilient against social manipulation.
Protecting engineering systems: Teams use immutable artifacts and run build and test processes in virtual environments. Decommissioning processes are defined. Standardized dynamic cloud developer workstations are created and destroyed on demand. MFA is enforced, with continuous authentication and dynamic verification of access and enrollments.
Forward-looking (Pioneering)
Organizations at this stage go beyond the fundamentals, optimize their approach, and use emerging technologies in ways that establish industry leadership in DevSecOps.
Security program: AI-driven tools and monitors help predict and defend against imminent risks. A sustained secure posture emerges, preventing regressions and limiting the introduction of new issues.
Policies and standards: DevSecOps strategies and emerging practices are reviewed regularly. The organization takes a leading role in AI governance and in sponsoring open source.
Protecting engineering systems: Build and test continue in virtual environments and add hermetic builds. Some scenarios apply stronger identity verification, including physical or biometric verification.