Compliance as Code is baked into Citizant’s CI/CD pipeline. Each stage in the pipeline has gated compliance thresholds. If any stage does not pass the defined threshold, the pipeline stops and sends notifications for remedial action. These thresholds are established by working with various stakeholders such as Enterprise Architecture, Cybersecurity, and operations teams. One customer’s Cybersecurity team has created a Secure Code Matrix (SCM)-CMMI level for each application, which is baked into our pipeline. All metrics generated by the pipeline are tracked and reported for actionable outcomes. Even the pipeline itself is subject to Change Control Board (CCB) acceptance. We developed an automated tool to review compliance against the Definition of Done for a pipeline, which feeds into the CCB.
Before we implemented our CI/CD pipeline at one agency, a development team would manually submit their source code to CISO team for scanning when the app was ready for production. The agency typically took 2-3 weeks to generate a security report, with additional expensive delays for issue resolution or executive waivers. To resolve this challenge, we collaborated with project teams and the CISO team to integrate the CISO’s preferred tool into our pipeline. We iterated frequently until we could demonstrate that the report generated from our pipeline matched the report generated manually by the CISO team. As a result of this collaboration, the CISO trusted the pipeline security report and would approve code for production deployment based on this report.