GRCLibrary.ai

Standard

DevOps Security Requirements

This standard defines security requirements for DevOps engineering: CI/CD pipelines, infrastructure as code, environment management, container security, and automation platform operational security. For production and infrastructure operations controls, see the operations domain. For developer security requirements, see the Developer Security Requirements Standard.

Type
Standard
Version
1.0.31
Date
2026-10-27
Owner
Chief Information Security Officer
Approving authority
Chief Information Officer
Classification
Public
Confidentiality
Public
Category
Developer Security
Review frequency
6 to 12 months and upon material tooling, threat, or infrastructure change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. CI/CD pipeline security
  • 3. Infrastructure as code (iac)
  • 4. Environment separation and promotion
  • 5. Container and platform security
  • 6. Cloud security configuration
  • 7. Multi-subscription and multi-account governance
  • 8. Automation platform operational security
  • 9. API gateway operational requirements
  • 10. Shared file system security
  • 11. Application service owner registry
  • 12. Framework and runtime EOL: DevOps requirements
  • 13. Framework alignment

Frameworks it maps to

Related documents