Compose a pipeline

GOV Governance and assurance

The stream that decides what blocks, and proves it blocked.

SUP Open source and third-party supply

Everything you did not write, arriving faster than you can review it.

DEV Design and development

Where the cost of a fix is lowest and the attention is shortest.

DEL Build and delivery

The machine that makes the thing, and the largest single target in the chain.

VER Testing and validation

The stream that finds out whether any of the others worked.

OPS Runtime and platform

The last place to stop something, and the most expensive.

OBS Detection and continuous observation

The only stream whose answer changes while nothing else does.

The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 47 targeted, 0 ignored, 286 still open, of 333. A ring means the cell is closed. Your 27 controls account for 47 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.

┊The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.