DevSecOps Software Factory

The distinction is whether the pipeline produces evidence as a by-product of building software. A CI/CD pipeline builds and deploys. A software factory in the Department's sense does that while emitting the artifacts an authorization depends on — what was scanned, what the results were, which gate passed, which build it applied to, and who approved an exception. If the security evidence has to be gathered separately from the pipeline afterwards, what exists is CI/CD with scanners attached.

You inherit the controls the platform provider documents as inheritable, which is a specific and bounded list rather than the platform's authorization as a whole. Everything above that line — your application, its configuration, its data handling, its own dependencies — remains yours. The recurring failure is a programme assuming a broader inheritance than the provider ever claimed and discovering the gap during assessment, when the controls in question have had no owner for months.

They give you a base image whose provenance and scan state are known, which removes a large and tedious category of finding. They stop helping at the point where you add anything: your own layers, dependencies pulled at build time, and runtime configuration are outside what the hardened base attests to. Container findings should be held against the image digest that was actually deployed rather than the tag that was requested, because tags move and digests do not.

It has to fail closed, be attributable, and be evidenced. A gate that can be bypassed without a recorded exception is not a control, because there is no way to show it was operating; a gate whose result is not tied to a specific build cannot support an assertion about what was deployed. This is the difference between a pipeline that reduces authorization effort and one that adds a dashboard: the first produces admissible evidence, the second produces reassurance.

A secure software supply chain is one of the three pillars the cATO construct rests on, alongside continuous monitoring and active cyber defence, so a pipeline that produces trustworthy evidence is necessary but not by itself sufficient. Programmes that build the factory and stop tend to find they can demonstrate how software was built and not what the deployed system's control posture currently is, which is the question the authorizing official is actually asking.