OSCAL?

[rosskarchner]

Hello!

I think it would be useful for the DevSecOps requirements to be made available as an OSCAL control library, which could then be imported into the sort of GRC tools that organizations might use to track their compliance with the requirements.

A more futuristic vision might involve vendors publishing component definitions that describe, in machine-readable format, how their tools can be configured to best satisfy these controls, and/or generate automated assessments results that helps organizations identify misconfigurations and how they impact DevSecOps posture.