Nine frameworks, Apache-2.0, published under Techstream.

1. 01

   DevSecOps Framework

   Where to put security in a delivery pipeline and which control goes at each phase. Inside: the architecture, a toolchain reference by pipeline phase, an implementation guide and a roadmap.

   github.com/sotille/devsecops-framework

2. 02

   Secure CI/CD Reference Architecture

   A pipeline has five places to attack: source, build environment, secrets, artifacts and deployment. Each one is threat-modelled and given its control, with implementation guides for GitHub Actions, GitLab CI and Jenkins and a maturity model to close.

   github.com/sotille/secure-ci-cd-reference-architecture

3. 03

   Release Orchestration Framework

   Release governance, environment promotion, approval workflows, orchestration, rollback and recovery, written for landscapes with many teams and many environments. Read it if you are the release manager or the programme lead who has to say when something may go to production.

   github.com/sotille/release-orchestration-framework

4. 04

   Software Supply Chain Security Framework

   From source to distribution: dependencies, build systems, artifacts and deployment environments, with the SBOM lifecycle and provenance as the basis for trust. It draws on SLSA, NIST SSDF, Executive Order 14028 and the EU Cyber Resilience Act, and it is written for the programme a team starts after SolarWinds, Log4Shell and XZ Utils.

   github.com/sotille/software-supply-chain-security-framework

5. 05

   DevSecOps Maturity Model

   Five levels across eight domains, a scoring questionnaire and a gap analysis. The lineage is CMMI, OWASP SAMM and BSIMM, extended to cloud-native and continuous delivery; the two-week assessment on the services page runs on this model.

   github.com/sotille/devsecops-maturity-model

6. 06

   Compliance Automation Framework

   Controls become policy as code, evidence is collected by the pipeline rather than by hand, and monitoring keeps it current, across cloud, Kubernetes and CI/CD. The control mapping covers SOC 2, ISO 27001 and PCI DSS, among others, so point-in-time compliance can be replaced with continuous evidence.

   github.com/sotille/compliance-automation-framework

7. 07

   DevSecOps Methodology

   A transformation in four phases, assess, design, implement, optimise, across culture, process, toolchain and governance. Inside: assessment frameworks and interview guides, target-state templates, 90-day and 18-month playbooks, RACI matrices and a security champions programme. For the CISO or platform lead sponsoring or running the programme.

   github.com/sotille/devsecops-methodology

8. 08

   AI DevSecOps Framework

   What changes in the pipeline when AI writes code and agents run in CI/CD: threat models, controls and governance for AI-assisted development, prompt-injection defence, the model supply chain and agent authorisation. It assumes a mature DevSecOps baseline and extends it to the AI surface, with GitHub Actions, GitLab CI and Kubernetes RBAC examples.

   github.com/sotille/ai-devsecops-framework

9. 09

   Forensics & Incident Response Framework

   Immutable and ephemeral infrastructure destroys evidence unless preservation is designed in. This repository is that design: what to log, where to keep it unaltered, how to correlate across domains, and investigation playbooks for CI/CD, cloud, supply-chain, identity and AI-agent incidents.

   github.com/sotille/forensics-and-incident-response-framework

Standards the frameworks map to

DORA, NIS2, the Cyber Resilience Act and the EU AI Act; SLSA, SSDF (NIST SP 800-218), ISO 27001, SOC 2, PCI DSS; CycloneDX and SPDX, Sigstore, OPA.