# DoD and NIST Develop DevSecOps Standards

On February 21, 2020, the Department of Defense and the National Institute of Standards and Technology were organizing a cross-industry effort to develop DevSecOps security standards and reference architecture, including guidance for Kubernetes and containers, cloud access controls, and continuous authorization to operate (cATO). An early draft was targeted for approximately April–May 2020, a date that has passed. The signal describes standards development—not a solicitation or contract award—so its procurement relevance is in aligning technology offerings and delivery practices with the emerging guidance.

- Contractors and technology providers can use the specified focus areas to assess whether their products, security evidence, and software delivery pipelines support containerized workloads, cloud access controls, and continuous authorization practices.
- The effort brought together DoD and NIST with cross-industry participants, signaling a government-wide interest in repeatable DevSecOps practices that can also apply to commercial and dual-use systems.
- No contract value, procurement vehicle, or active bid opportunity is identified in the signal.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Cloud Services
**Published:** October 27, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)
- U.S. Air Force (USAF)
- Department of Defense Chief Information Officer office (DoD CIO)

### Vendors
- Microsoft ()
- Red Hat ()
- VMware ()
- StackRox ()
- Rancher ()

### Key Quotes
> But there has been a technology explosion where most systems are dual-use, designed for both government and commercial use -- and adversaries have the same technology.
> — Ronald S. Ross, NIST fellow

### Sources
- [Massive DoD DevSecOps standards push may aid enterprise IT | TechTarget](https://www.techtarget.com/news/Massive-DoD-DevSecOps-standards-push-may-aid-enterprise-IT/864511) - TechTarget