Secure Software Delivery — DevSecOps Operating Model

Colour by Select any element for the control detail and the risk of not having it.

BUSINESS & REGULATORY DRIVERS Secure by Design (10 principles) · NCSC CAF v4.0 · GovS 007 · GDS Service Standard · UK GDPR · OWASP ASVS & SAMM · NCSC secure development Accountable: SIRO | CISO | Director of Digital | Head of Security Architecture | SROs & Service Owners | Delivery Leads

BUSINESS ATTRIBUTES | THE SECURITY OUTCOMES EVERY SERVICE MUST EXHIBIT

Security domains of the software delivery lifecycle

The toolchain

The pipeline, end to end

SECURE BY DESIGN STAGES

FEEDBACK LOOP — SAST, SCA and quality findings, cloud posture alerts and SOC detections return to PLAN and CODE, and revise the golden pipeline that let them through

GOVERNANCE CADENCE Daily Pipeline health · blocked builds · secret alerts Weekly SAST / SCA severity burn-down + SLA breach Monthly Design Authority · exception review · golden pipeline release Quarterly GovAssure / CAF return · toolchain assurance review

PIPELINE GATES — WHAT BLOCKS, WHAT WARNS A gate that only warns is a preference. Every BLOCK below is a control with an owner, and every bypass is a time-bound Design Authority exception (B-07).

DEVSECOPS PIPELINE — BPMN PROCESS MODEL

Click a shape, or run a scenario to trace a path

Scenarios

Notation

Activity — something is done

Gateway — a decision splits the flow

Start event

End event

Sequence flow

Message flow — crosses a pool

Traced by the active scenario

How to read it

Lanes show who or what performs the step. The eight pipeline gates appear as gateways, each tagged with its gate number so it ties back to the operating model tab. Where a shape maps to a control, the panel below offers a link straight to its detail.

Overview

Secure software delivery pipeline

From a change being raised to a conformant service running in the cloud, with every security gate shown where it actually sits. Five lanes carry the work: the delivery team, source control, the CI/CD orchestrator, the security tooling, and the cloud platform. Two pools beneath show where the process leaves the pipeline — to the Security Architecture tower for an exception or a risk position, and to the Security Operations tower for detection.

Model reference

Secure by Design lifecycle8 pipeline gates

Gateways marked G1 to G8 correspond to the pipeline gates on the operating model tab. Blocking outcomes are shown in red on the flow labels.

PIPELINE DEPENDENCY MODEL AND = every child required · OR = any path suffices · availability figures illustrative. The scale is coverage-weighted effectiveness — the share of in-scope changes where the control is both present and working. A box with children is scored by its weakest dependency and names it underneath; the combined product is in the detail panel. As-is is the position today; to-be is the position once the planned artefacts land. The gap between the two views is the investment case.

INT internal to the tower EXT external — MSP or platform SHR shared ≥93% 82–92% 70–82% 40–70% <40%

Weakest link, as-is —

Every branch is an AND gate, so a weak child pulls its parent down — which is why a composite box takes the score of its weakest dependency rather than the product of all of them. Select any box for its detail, or hover to highlight what it connects to. Availability figures are an illustrative opening position for a baselining conversation, not an assessment.