CISA Cloud Security Technical Reference Architecture v2.0
Section 4: Cloud migration – CISA Cloud Security Technical Reference Architecture v2.0

CISA Cloud Security Technical Reference Architecture v2.0 4.4a: Make DevSecOps the primary approach, with CI/CD and infrastructure as code

What does 4.4a require?

DevSecOps is the primary way the agency develops, secures and delivers cloud applications, with cross-functional teams owning development, launch and maintenance; continuous integration automates integration, build and test, source control enforces code review and check-in procedures, continuous delivery releases tested code at regular intervals against defined pass and fail criteria, and infrastructure is written as code so that provisioning, runtime change and decommissioning are automated, reviewable and documented, patches roll out at scale, compliance checks and access policies deploy as code, and the code itself is monitored for misconfiguration and audited before production.

Maintained by Gerard Blokdyk

Other controls in Section 4: Cloud migration – CISA Cloud Security Technical Reference Architecture v2.0

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.