Integrating Zero Trust and DevSecOps
• SEI Report
Publisher
Software Engineering Institute
Abstract
Zero trust (ZT) and DevSecOps are popular strategies that leverage automation to execute organizational processes and workflows. ZT is a security strategy that uses policy to enforce explicit trust between subjects and resources. DevSecOps is a development strategy that combines tools and agility to continuously develop and operate software. Both strategies are interdependent and require balancing concerns of how services, data, and infrastructure must be shared to achieve efficiency, cost effectiveness, and risk mitigation for continuous authority to operate (cATO). A mission thread that focuses on the lifecycle of an application being developed within a DevSecOps environment is used to provide the context for this discussion.
Cite This SEI Report
Sanders, G., Morrow, T., Richmond, N., & Woody, D. (2021, July 5). Integrating Zero Trust and DevSecOps. Retrieved August 19, 2026, from https://www.sei.cmu.edu/library/integrating-zero-trust-and-devsecops/.
@techreport{sanders_2021,
author={Sanders, Geoff and Morrow, Timothy and Richmond, Nathaniel and Woody, Dr. Carol},
title={Integrating Zero Trust and DevSecOps},
month={Jul},
year={2021},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/integrating-zero-trust-and-devsecops/},
note={Accessed: 2026-Aug-19}
}
Sanders, Geoff, Timothy Morrow, Nathaniel Richmond, and Dr. Carol Woody. "Integrating Zero Trust and DevSecOps." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, July 5, 2021. https://www.sei.cmu.edu/library/integrating-zero-trust-and-devsecops/.
G. Sanders, T. Morrow, N. Richmond, and D. Woody, "Integrating Zero Trust and DevSecOps," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 5-Jul-2021 [Online]. Available: https://www.sei.cmu.edu/library/integrating-zero-trust-and-devsecops/. [Accessed: 19-Aug-2026].
Sanders, Geoff, Timothy Morrow, Nathaniel Richmond, and Dr. Carol Woody. "Integrating Zero Trust and DevSecOps." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 5 Jul. 2021. https://www.sei.cmu.edu/library/integrating-zero-trust-and-devsecops/. Accessed 19 Aug. 2026.
Sanders, Geoff; Morrow, Timothy; Richmond, Nathaniel; & Woody, Dr. Carol. Integrating Zero Trust and DevSecOps. Software Engineering Institute. 2021. https://www.sei.cmu.edu/library/integrating-zero-trust-and-devsecops/