Defining governance in DevSecOps

So far, we have drafted a DevSecOps architecture, identified processes, and then aligned these with the business goals of the enterprise. The next step is to manage all this, and that's the subject of governance. DevSecOps is not just a PowerPoint presentation and a Visio diagram showing the CI/CD pipelines. An enterprise needs skilled staff to work with it and a governance model that describes the secured digital operating model. In this section, we will discuss this by using the IT4IT framework by The Open Group as a best practice.

In Chapter 6, Defining Operations in Architecture, we introduced value streams for products and described how IT creates value. The model can be seen in the following diagram:

Figure 14.1 – IT4IT value streams

In IT4IT, Governance, Risk, and Compliance (GRC) is a supporting activity for the four value streams. This means that GRC is fully embedded in every value stream. What does...