When DevOps Meets Regulation: Integrating 'Continuous' with 'Government'
summary
Claims that continuous delivery can work inside the US federal risk and compliance regime, and shows concrete steps: builds a platform-as-a-service (public GitHub repos) that takes responsibility for many FedRAMP controls, generates paperwork from machine-readable YAML via compliance-masonry, and publishes a System Security Plan (SSP) so teams can reuse templates. Procurement uses an agile BPA requiring working open-source prototypes. Result: authority-to-operate time drops from 6–14 months toward weeks and the team aims for days; platform proofs are already in use.
AI-written summary · about
chapters (13)
- 0:00Intro
- 3:05What is continuous delivery
- 6:17US government information systems checklist
- 9:06Security and privacy controls
- 15:58Authority to operate
- 18:41The DevOps problem
- 20:48CloudGov
- 23:21OpenControl
- 30:51QA
- 33:26Low Baseline
- 36:51Magic
- 41:51Agile BPA
- 45:04Question
related talks
43mRegulatory Compliance as a DevOps Enabler
44mDevOps in Regulatory Spaces: It's Only 25% What You Thought It Was…
29mBusting Silos & Red Tape: DevOps in Federal Government
32mContinuous Delivery Sounds Great But It Won’t Work Here
37mCompliance & Regulatory Standards Are NOT Incompatible with Modern Development..
37mDevOps - The Automation of Compliance
33mCompliance as Code - Lessons Learned From Regulated Organizations
48mDesigning a Secure Software Development Lifecycle with DevOps