NIST DevSecOps draft resources

Secure software delivery depends on how security is built into the pipeline.

NIST’s National Cybersecurity Center of Excellence is accepting feedback on updated DevSecOps project resources through November 9, 2026. Announced September 24, the material includes: • A mapping of Secure Software Development Framework (SSDF) practices to a DevSecOps reference model • A second example implementation focused on CI/CD automation and containerized deployment • Functional scenarios across the software lifecycle and an appendix explaining SSDF task objectives

For federal delivery teams and suppliers, the practical value is the connection between security practices and actual pipeline activities. Review how your development environments, access controls, security checks and release evidence align with the published examples, and identify where the guidance needs clarification.

These are draft project resources open for comment, not a new final standard or an automatic contract change.

NIST also has a free October 28 webinar, 1–3 p.m. EDT, covering the project and the planned role of agentic super intelligence in Build 3. Attendance is limited to 500; the official event page provides registration and recording details.

Official project, live document and comment instructions: https://lnkd.in/d25yqbmJ

Webinar details: https://lnkd.in/eDbsgNcC

Illustrative keyboard photo: Raysonho / Open Grid Scheduler, May 2015, CC0 public-domain dedication. It does not depict a NIST system; no endorsement implied. https://lnkd.in/ejfNhCwF

#DevSecOps #SecureSoftware #FederalIT #CyberDefenseGroup