Holding on to Compliance While Adopting DevSecOps: An SLR
Open accessAbstract
The software industry has witnessed a growing interest in DevSecOps due to the premises of integrating security in the software development lifecycle. However, security compliance cannot be disregarded, given the importance of adherence to regulations, laws, industry standards, and frameworks. This study aims to provide an overview of compliance aspects in the context of DevSecOps and explore how compliance is ensured. Furthermore, this study reveals the trends of compliance according to the extant literature and identifies potential directions for further research in this context. Therefore, we carried out a systematic literature review on the integration of compliance aspects in DevSecOps, which rigorously followed the guidelines proposed by Kitchenham and Charters. We found 934 articles related to the topic by searching five bibliographic databases (163) and Google Scholar (771). Through a rigorous selection process, we selected 15 papers as primary studies. Then, we identified the compliance aspects of DevSecOps and grouped them into three main categories: compliance initiation, compliance management, and compliance technicalities. We observed a low number of studies; therefore, we encourage further efforts into the exploration of compliance aspects, their automated integration, and the development of metrics to evaluate such a process in the context of DevSecOps.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Compliance automation is recognised as underexplored in both research and industry practice.
“Compliance and risk management appear as additional focal points, with compliance automation recognised as underexplored in both research and industry practice [25].”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [25]
The Discussion and Future Work section (page unavailable) reports a low number of studies on integrating compliance into DevSecOps, supporting the research-gap portion of the claim. It also notes challenges automating compliance validation, but does not establish that compliance automation is underexplored across industry practice. (LLM, conf=0.82)
Experimental — accuracy not yet measuredRamaj et al. [25] and Rajapakse et al. [28] document the technical, cultural, and compliance-related barriers organisations face when adopting DevSecOps.
“Ramaj et al. [25] and Rajapakse et al. [28] document the technical, cultural, and compliance-related barriers organisations face when adopting DevSecOps, while other works provide prescriptive strategies for change management and migration.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [25]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
General Data Protection Regulation (GDPR)
Deaves, M. (2017) · Cited by 815 · see citing works
McGraw, G. E. (2004) · IEEE Security & Privacy · doi:10.1109/msecp.2004.1281254 · Cited by 511 · see citing works
Big data’s impact on privacy, security and consumer welfare
Kshetri, N. (2014) · Telecommunications Policy · doi:10.1016/j.telpol.2014.10.002 · Cited by 300 · see citing works
Challenges and solutions when adopting DevSecOps: A systematic review
Rajapakse, R. N., Zahedi, M., Babar, M. A., & Shen, H. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2021.106700 · Cited by 235 · see citing works
DevOps Adoption Benefits and Challenges in Practice: A Case Study
Riungu-Kalliosaari, L., Mäkinen, S., Lwakatare, L. E., Tiihonen, J., & Männistö, T. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-49094-6_44 · Cited by 154 · see citing works
SecDevOps: Is It a Marketing Buzzword? - Mapping Research on Security in DevOps
Mohan, V., & Othmane, L. B. (2016) · 2016 11th International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2016.92 · Cited by 112 · see citing works
Kumar, R., & Goyal, R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101967 · Cited by 97 · see citing works
Towards code compliance checking on the basis of a visual programming language
Preidel, C., & Borrmann, A. (2016) · Journal of Information Technology in Construction · Cited by 86 · see citing works
Towards Building an Automated Security Compliance Tool for the Cloud
Ullah, K. W., Ahmed, A. S., & Ylitalo, J. (2013) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom.2013.195 · Cited by 54 · see citing works
Forsgren, N., & Kersten, M. A. (2018) · Communications of the ACM · doi:10.1145/3159169 · Cited by 54 · see citing works
Service level agreement‐based GDPR compliance and security assurance in(multi)Cloud‐based systems
Rios, E., Iturbe, E., Larrucea, X., Rak, M., Mallouli, W., Dominiak, J., Muntés, V., Matthews, P., & Gonzalez, L. (2019) · IET Software · doi:10.1049/iet-sen.2018.5293 · Cited by 43 · see citing works
An Integrative Behavioral Model of Information Security Policy Compliance
Kim, S. H., Yang, K. H., & Park, S. (2014) · The Scientific World JOURNAL · doi:10.1155/2014/463870 · Cited by 42 · see citing works
Carter, K. (2017) · IEEE Software · doi:10.1109/ms.2017.3571578 · Cited by 42 · see citing works
Mohan, V., Othmane, L. B., & Kres, A. (2018) · IEEE Cybersecurity Development (SecDev) · doi:10.1109/secdev.2018.00011 · Cited by 34 · see citing works
Julisch, K. (2008) · New Security Paradigms Workshop · doi:10.1145/1595676.1595687 · Cited by 33 · see citing works
Enterprise-Driven Open Source Software: A Case Study on Security Automation
Angermeir, F., Voggenreiter, M., Moyon, F., & Mendez, D. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00037 · Cited by 30 · see citing works
Santos, C. T., Bielova, N., & Matte, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.07144 · Cited by 27 · see citing works
Daud, M., Rasiah, R., George, M. B., Asirvatham, D. A. L., & Thangiah, G. (2018) · The University of Malaya Research Repository (University of Malaya) · Cited by 25 · see citing works
Towards a Hypothetical Framework to Secure DevOps Adoption
Rafi, S., Wu, Y. C., & Akbar, M. A. (2020) · International Conference on Evaluation and Assessment in Software Engineering (EASE) · doi:10.1145/3383219.3383285 · Cited by 24 · see citing works
Policies alone do not constitute a sufficient awareness effort
Wood, C. C. (1997) · Computer Fraud & Security · doi:10.1016/s1361-3723(00)80007-x · Cited by 21 · see citing works
DevOps in an ISO 13485 Regulated Environment: A Multivocal Literature Review
Lie, M. F., Sánchez-Gordón, M., & Colomo-Palacios, R. (2020) · Proceedings of the 14th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM) · doi:10.1145/3382494.3410679 · Cited by 21 · see citing works
Self-citationOntology-driven evolution of software security
Peldszus, S. M., Bürger, J., Kehrer, T., & Jürjens, J. (2021) · Data & Knowledge Engineering · doi:10.1016/j.datak.2021.101907 · Cited by 20 · see citing works
A systems-of-systems security framework for requirements definition in cloud environment
Carturan, S. B. O. G., & Goya, D. (2019) · European Conference on Software Architecture · doi:10.1145/3344948.3344977 · Cited by 18 · see citing works
Evolving Technologies for Computing, Communication and Smart World
(2020) · Lecture notes in electrical engineering · doi:10.1007/978-981-15-7804-5 · Cited by 18 · see citing works
Software Process Improvement and Capability Determination
(2017) · Communications in computer and information science · doi:10.1007/978-3-319-67383-7 · Cited by 17 · see citing works
Best Practices for Ensuring Security in DevOps: A Case Study Approach
Desai, R., & Nisha, T. N. (2021) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1964/4/042045 · Cited by 16 · see citing works
Incremental Common Criteria Certification Processes using DevSecOps Practices
Dupont, S., Ginis, G., Malacario, M., Porretti, C., Maunero, N., Ponsard, C., & Massonet, P. (2021) · 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw54576.2021.00009 · Cited by 16 · see citing works
Challenges and solutions when adopting DevSecOps: A systematic review
Rajapakse, R. N., Zahedi, M., Babar, M. A., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.08266 · Cited by 15 · see citing works
Security Audit of Docker Container Images in Cloud Architecture
Ahamed, W. S. S., Zavarsky, P., & Swar, B. (2021) · International Conference on Secure Cyber Computing and Communications (ICSCCC) · doi:10.1109/icsccc51823.2021.9478100 · Cited by 12 · see citing works
Product-Focused Software Process Improvement
Maurizio Morisio, M. T., Morisio, M., Torchiano, M., & Jedlitschka, A. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64148-1 · Cited by 11 · see citing works
Design and Implementation of Security Test Pipeline based on DevSecOps
Sun, X., Cheng, Y., Qu, X., & Li, H. (2021) · IEEE Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC) · doi:10.1109/imcec51613.2021.9482270 · Cited by 10 · see citing works
Compliance at Velocity within a DevOps Environment
Abrahams, M. Z., & Langerman, J. (2018) · doi:10.1109/icdim.2018.8847007 · Cited by 9 · see citing works
Jimenez‐Maggiora, G. A., Bruschi, S., Qiu, H., So, J., & Aisen, P. S. S. (2022) · JAMIA Open · doi:10.1093/jamiaopen/ooab119 · Cited by 9 · see citing works
Towards Data-driven Continuous Compliance Testing
Steffens, A., Lichter, H., & Moscher, M. (2018) · RWTH Publications (RWTH Aachen) · Cited by 5 · see citing works
Zeeshan, A. A. (2020) · Apress eBooks · doi:10.1007/978-1-4842-5850-7 · Cited by 3 · see citing works
Chatterjee, R. (2020) · Apress eBooks · doi:10.1007/978-1-4842-6434-8 · Cited by 3 · see citing works
A Novel Approach to Onboarding Secure Cloud-Native Acquisitions into Enterprise Solutions
Vadlamudi, S., & Sam, J. (2021) · doi:10.1109/centcon52345.2021.9688193 · Cited by 2 · see citing works
Devsecops for Small and Medium-Sized Enterprises: A Systematic Literature ReviewPreprint
Lee, J., Kang, K., & Shim, C. (2022) · SSRN Electronic Journal · doi:10.2139/ssrn.4010320 · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 6
- Zeeshan, A.A., Ed.; Apress: Berkeley, CA, USA, 2020; pp. 265-278. ISBN 978-1-4842-5850-7.
- Kitchenham, B.; Charters, S. Guidelines for Performing Systematic Literature Reviews in Software Engineering 2007. Available online: https://www.researchgate.net/profile/Barbara-Kitchenham/publication/302924724_Guidelines_for_performing_Sys tematic_Literature_Reviews_in_Software_Engineering/links/61712932766c4a211c03a6f7/Guidelines-for-performing-System atic-Literature-Reviews-in-Software-Engineering.pdf (accessed on 22 February 2022).
- Chatterjee, R., Ed.; Apress: Berkeley, CA, USA, 2021; pp. 65-104. ISBN 978-1-4842-6434-8.
- Abrahamsson, P., Jedlitschka, A., Nguyen Duc, A., Felderer, M., Amasaki, S., Mikkonen, T., Eds.; Lecture Notes in Computer Science; Springer International Publishing: Cham, Switzerland, 2016; Volume 10027, pp. 590-597. ISBN 978-3-319-49093-9.
- Rahman, A.A.U.; Williams, L. Software Security in DevOps: Synthesizing Practitioners' Perceptions and Practices. In Proceedings of the 2016 IEEE/ACM International Workshop on Continuous Software Evolution and Delivery (CSED), Austin, TX, USA, 14-15 May 2016; pp. 70-76.
- Singh, P.K., Noor, A., Kolekar, M.H., Tanwar, S., Bhatnagar, R.K., Khanna, S., Eds.; Springer: Singapore, 2021; pp. 211-221.
Cited by
Sorted by citations
Abiona, O. O., Oladapo, O. J., Modupe, O. T., Oyeniran, O. C., Adewusi, A. O., & Komolafe, A. M. (2024) · World Journal of Advanced Engineering Technology and Sciences · doi:10.30574/wjaets.2024.11.2.0093 · Cited by 48 · see citing works
Boisrond, K., Tardif, P.-M., & Jaafar, F. (2024) · IEEE Access · doi:10.1109/access.2024.3434618 · Cited by 27 · see citing works
Valdés, Y., Hochstetter-Diez, J., Diéguez, M., Bustamante-Mora, A., & Martínez, R. C. (2024) · IEEE Access · doi:10.1109/access.2024.3372385 · Cited by 18 · see citing works
Compliance and Audit Challenges in DevOps: A Security Perspective
(2023) · International Research Journal of Modernization in Engineering Technology and Science · doi:10.56726/irjmets45309 · Cited by 13 · see citing works
Integrating security controls in DevSecOps: Challenges, solutions, and future research directions
Sinan, M., Shahin, M., & Gondal, I. (2025) · Journal of Software: Evolution and Process · doi:10.1002/smr.70029 · Cited by 13 · see citing works
GATEKEEPER Platform: Secure Processing Environment for European Health Data Space
Gaeta, E., Haleem, M. S., Lopez-Perez, L., Manea, M., Cabrera-Umpiérrez, M. F., Arredondo, M. T., Pecchia, L., & Fico, G. (2025) · IEEE Access · doi:10.1109/access.2025.3539559 · Cited by 11 · see citing works
Dinh, N. T., Hoang, V. T., Van, B. N., Huong, T. H., Hong, H. D. T., Trung, H. N., & Tran-Trung, K. (2025) · IEEE Access · doi:10.1109/access.2025.3606572 · Cited by 8 · see citing works
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8 · see citing works
Towards a DevSecOps-Enabled Framework for Risk Management of Critical Infrastructures
Ramaj, X., Colomo‐Palacios, R., Sánchez‐Gordón, M., & Gkioulos, V. (2023) · Communications in computer and information science · doi:10.1007/978-3-031-42307-9_4 · Cited by 7 · see citing works
Self-citationKhadem, E. A., & Movaghar, A. (2025) · Array · doi:10.1016/j.array.2025.100547 · Cited by 10 · see citing works
Industrial Challenges in Secure Continuous Development
Moyón, F., Angermeir, F., & Méndez, D. (2024) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3639477.3639736 · Cited by 6 · see citing works
Corona-Fraga, P., Hernandez-Suarez, A., Sanchez-Perez, G., Toscano, K., Perez-Meana, H. M., Portillo-Portillo, J., Olivares-Mercado, J., & Villalba, L. J. G. (2025) · Future Internet · doi:10.3390/fi17010033 · Cited by 5 · see citing works
Supporting continuous vulnerability compliance through automated identity provisioning
Gama, D., Brito, A., Martin, A., & Fetzer, C. W. (2024) · Latin-American Symposium on Dependable Computing · doi:10.1145/3697090.3697098 · Cited by 4 · see citing works
Integrating Site Reliability Engineering Principles with DevSecOps for Enhanced Security Posture
Tabbassum, A., Malik, V., Singh, J., & Surendranath, N. (2024) · International Conference on Intelligent Systems and Advanced Applications (ICISAA) · doi:10.1109/icisaa62385.2024.10828869 · Cited by 4 · see citing works
Large-scale agile security practices in software engineering
Ascenção, C., Teixeira, H., Gonçalves, J., & Almeida, F. L. (2024) · Information and Computer Security · doi:10.1108/ics-07-2023-0136 · Cited by 4 · see citing works
Network Security Governance Policy and Risk Management: Research on Challenges and Coping Strategies
Zhong, J., Wang, X., & Zhang, T. (2024) · Journal of Machine and Computing · doi:10.53759/7669/jmc202404015 · Cited by 3 · see citing works
Serious Game for Industrial Cybersecurity: Experiential Learning Through Code Review
Iosif, A.-C., Lechner, U., Pinto-Albuquerque, M., & Espinha, T. (2024) · IEEE International Conference on Software Engineering Education and Training (CSEE&T) · doi:10.1109/cseet62301.2024.10663058 · Cited by 2 · see citing works
ITSM BASED CHANGE MANAGEMENT AUTOMATION IN CLOUD ENVIRONMENTS: A CROSS SECTOR EMPIRICAL STUDY
Jyoti, S. N. (2025) · doi:10.63125/xvjst226 · Cited by 5 · see citing works
Infrastructure Driven DevOps in Regulated Markets: A Case Study of Indonesia’s Financial Sector
Sucipto, P. A. (2024) · Digitus Journal of Computer Science Applications · doi:10.61978/digitus.v2i1.949 · Cited by 1 · see citing works
Aligning security compliance and DevOps: a longitudinal study
Moyón, F., Angermeir, F., Méndez, D., Gorschek, T., Voggenreiter, M., & Bonvin, P. (2025) · Journal of Systems and Software · doi:10.1016/j.jss.2025.112718 · Cited by 1 · see citing works
Leveraging zero trust and risk indicators to support continuous vulnerability compliance
Gama, D., Fuch, C., Brito, A., Martin, A., & Fetzer, C. W. (2026) · Journal of Internet Services and Applications · doi:10.5753/jisa.2026.5922 · Cited by 1 · see citing works
Regulatory and Security Compliance for Software In Cloud Ecosystems – a Systematic Literature ReviewPreprint
Ganapathy, V. (., & Sampath, S. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5087363 · Cited by 1 · see citing works
Ramdass, K. (2025) · Research Square · doi:10.21203/rs.3.rs-8089587/v1 · Cited by 1 · see citing works
DevSecOps Practices for GDPR, HIPAA or LGPD Compliance in Software Development: A Systematic Review
de Freitas, D. S. A., de Oliveira, A. A., Moreno, E. D., & da Silva, G. J. F. (2025) · Anais do Simpósio Brasileiro de Sistemas de Informação (SBSI) · doi:10.5753/sbsi.2025.246400
Centralized Management in Multi-Account AWS Environments: A Security and Compliance Perspective
Thallam, N. S. T. (2023) · International Journal of Emerging Trends in Computer Science and Information Technology · doi:10.63282/3050-9246.ijetcsit-v4i3p103
AI-Augmented DevSecOps for Cloud-Native Security Automation
Solaimalai, G. (2025) · International Conference on Recent Innovation in Science Engineering and Technology (ICRISET) · doi:10.1109/icriset64803.2025.11252281
Darbali, A., Tigani, S., Chaibi, H., Saadane, R., Chehri, A., Jakimi, A., & Minaoui, K. (2026) · Smart innovation, systems and technologies · doi:10.1007/978-3-032-04878-3_9
Morić, Z., Balković, M., & Isić, D. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6020061
Implementing DevSecOps: A Systematic Literature Review on Integrating Security into DevOps
Guyong, J. A., Balaybay, R. M., Macario, J. M., Pangan, E. J., & Clemente, J. R. D. (2025) · World Symposium on Software Engineering (WSSE) · doi:10.1145/3779657.3779664
Iosif, A.-C., Lechner, U., Pinto-Albuquerque, M., & Espinha, T. (2026) · Lecture notes in information systems and organisation · doi:10.1007/978-3-032-08489-7_11
Evaluating DevOps, DevSecOps, MLOps and CloudOps–Results from an Adapted MLR
Yakushenko, A., McCann, R., Hughes, C., McElligott, S., Yılmaz, M., MacMahon, S. T., Mccarren, A., & McCarren, A. L. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-36813-3_6
Huralnyk, O., САВЕНКО, Б., & Sachenko Svitlana, I. (2026) · International Conference on Advanced Computer Information Technologies (ACIT) · doi:10.1109/acit69831.2026.11700035
Compliance-as-Code: Automating Evidence Collection with Human-in-the-Loop Review
Muralinath, R. (2026) · International Journal of Scientific Research in Computer Science Engineering and Information Technology · doi:10.32628/cseit2612528
- Authors
- Ramaj, X., Sánchez-Gordón, M., Gkioulos, V., Chockalingam, S., & Colomo-Palacios, R.
- Affiliations
- Østfold University of Applied Sciences (NO)
- Department of Computer Science and Communication, Faculty of Computer Sciences, Engineering and Economics, Østfold University College, 1757 Halden, Norway
- Norwegian University of Science and Technology (NO)
- Institute for Energy Technology (NO)
- ORCID
- Venue
- Electronics
- Publisher
- MDPI AG
- Published
- 2022-11-12
- Volume
- 11
- Issue
- 22
- Pages
- 3707
- ISSN
- 2079-9292 (ISSN-L)
- OpenAlex
- W4309035093
- Cited by
- 33
- References
- 36
- Citations by year
- 2026: 7 · 2025: 13 · 2024: 10 · 2023: 3
- FWCI
- 6.44
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Electronics (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- NORA - Norwegian Open Research Archives (submittedVersion, cc-by)
- Funders
- Research Council of Norway (RCN) (#309911)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- DevSecOps, security compliance, software development lifecycle, compliance management, security automation, compliance metrics
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
