The Big Picture: Defense DevSecOps runs on a knowable set of documents, platforms, and tools. This index collects them in one place — the same sources cited across the Secure Delivery series.

---

Why It Matters

Half the time lost on a defense software program is spent finding the authoritative document or the right tool, not reading it. Bookmark this page instead. Every link is the primary source or the working tool — no vendor summaries in between.

The Details

• Policy & Strategy: The DoD-level documents that set the rules — CSRMC, DoDI 8510.01, the Zero Trust Strategy, cATO criteria.
• NIST Publications: The control catalogs and frameworks the evidence maps to.
• Platforms & Pipeline Tools: Platform One services and the open-source tools that produce the evidence.
• Compliance & Training: CMMC bodies, assessment portals, and where to build the skills.

Bolding indicates resources I use or have used directly; non-bolded links are curated for reference. Verify the current version of any policy document before citing it — issuances change.

Start here Curated paths

Policy path Policy & Strategy New to defense compliance? Start with the documents that set the rules of the game. Builder path Pipeline & DevOps Tools Jump here for the scanners, policy engines, and GitOps controllers that produce evidence. Platform path Platform One & Cloud Use these when you're deploying on DoD platforms and inheriting their controls. Compliance path CMMC & Assessment Start here when a contract clause or a C3PAO assessment is the forcing function.

Featured resources High-signal sources

PlatformPlatform One HardeningDISA STIGs ControlsNIST SP 800-53 FrameworkDoD CSRMC Policy engineOpen Policy Agent SigningSigstore

Filter the index

Go Deeper

Resource Index

• DoD Policy & Security Strategy
  • DoD CIO Cybersecurity Risk Management Construct (CSRMC) — the RMF replacement; covered in my RMF 2.0 post
  • CSRMC Strategic Tenets — the ten tenets, one page each
  • DoDI 8510.01 — Risk Management Framework for DoD Systems — still the issuance of record during transition
  • Continuous ATO Evaluation Criteria — what the DoD actually checks; pairs with my cATO post
  • DoD Zero Trust Strategy — the FY2027 mandate; covered here
  • DoD AI Cybersecurity Risk Management Tailoring Guide — how models get authorized; covered in ATO for AI Systems
  • EO 14028 — Improving the Nation’s Cybersecurity — the order behind SBOM and ZT mandates
  • DoD CIO Library — the index of record when you need the current version of anything above
• NIST Security Publications & Frameworks
  • SP 800-37r2 — Risk Management Framework — the framework CSRMC restructures
  • SP 800-53r5 — Security and Privacy Controls — the control catalog everything maps to
  • SP 800-171r3 — Protecting CUI — the CMMC Level 2 baseline
  • SP 800-172 — Enhanced Requirements for CUI — the Level 3 delta
  • SP 800-207 — Zero Trust Architecture — the ZT reference model
  • SP 800-218 — Secure Software Development Framework — the EO 14028 development standard
  • SP 800-161r1 — Supply Chain Risk Management — the C-SCRM practices behind the SR controls
  • OSCAL — Open Security Controls Assessment Language — machine-readable compliance; the foundation of cATO evidence
  • NIST AI Risk Management Framework — Govern, Map, Measure, Manage
  • SP 800-53 Control Overlays for Securing AI Systems (COSAIS) — the AI overlays, drafts landing Q3 2026
• Platform One & DoD Cloud Services
  • Platform One — the DoD DevSecOps platform; the reference cATO implementation
  • Iron Bank — hardened container registry with inheritance-ready assessments
  • Iron Bank Documentation — onboarding and hardening requirements for getting an image accepted
  • Big Bang — the P1 Kubernetes baseline (Istio, Kyverno, Falco) as code
  • Repo One — DoD source repository; pipelines with mandatory policy gates
  • DoD Cyber Exchange — STIGs, SRGs, and cyber policy in one place
  • DISA STIGs — the hardening baselines assessors check against
  • NSA/CISA Kubernetes Hardening Guidance — the K8s baseline worth reading before the STIG
• Pipeline Security & DevOps Tooling
  • Open Policy Agent — policy as code; the engine behind most pipeline gates (my PaC post)
  • Kyverno — Kubernetes-native policy; easier entry than Rego for K8s-only shops
  • OPA Gatekeeper — OPA as a K8s admission controller
  • Checkov — IaC scanning for Terraform, CloudFormation, K8s manifests
  • Trivy — container and dependency scanning plus SBOM generation in one pass
  • Semgrep — SAST with writable rules; tune it for LLM failure modes (why that matters)
  • Argo CD — GitOps controller; declarative state reconciliation (the GitOps case)
  • Flux — the other GitOps controller; lighter footprint, same principle
  • detect-secrets — pre-commit secret scanning; cheapest control you’ll ever implement
• Supply Chain & SBOM Security
  • Syft — SBOM generation for containers and filesystems; SPDX and CycloneDX output
  • Grype — vulnerability correlation against the SBOM
  • cdxgen — CycloneDX-native generation; strongest polyglot support
  • OWASP Dependency-Track — continuous SBOM monitoring against new CVEs
  • Sigstore / cosign — artifact signing and verification
  • SLSA — supply chain integrity levels; the provenance framework
  • SPDX — the ISO SBOM format
  • CycloneDX — the OWASP SBOM format; native VEX support
  • CISA SBOM Resources — minimum elements and current guidance (my SBOM post)
  • OSV — open source vulnerability database
  • NVD — the National Vulnerability Database
• CMMC, Compliance & Security Assessment
  • CMMC Program (DoD CIO) — the official program page; start here, not with vendors (my CMMC post)
  • The Cyber AB — the accreditation body; C3PAO marketplace
  • DIBNet — the 72-hour incident reporting portal; know it before you need it
  • eMASS (DCSA) — where authorization packages live
  • Lula — validates K8s state against OSCAL-defined controls
  • Compliance Trestle — the OSCAL SDK for automating SSP and assessment artifacts
  • FedRAMP — cloud service authorization; the inheritance source for most SaaS controls
• Getting Started: Education & Training
  • DoD Cyber Exchange Training — free role-based training, including RMF and ZT courses
  • Defense Acquisition University — acquisition and cybersecurity credentials; free for the workforce
  • CIS Critical Security Controls — the threat-informed control set behind Army RMF 2.0’s baseline
  • MITRE ATT&CK — the adversary behavior catalog; the “threat” in threat-informed
  • NIST RMF Small Enterprise Quick Start — the plain-language RMF walkthrough
  • The Secure Delivery series on this blog — GitOps → Policy as Code → Zero Trust → CMMC → SBOM → cATO, in reading order

TOC

---

The Bottom Line

A trusted DevSecOps ecosystem relies on authoritative primary sources, continuous scanning, and standardized platform infrastructure. Bookmark these core references to ground your software delivery pipelines in verified standards rather than vendor noise.