The Secure Software Delivery Working Group brings together the DevSecOps and cATO working groups to strengthen security across the software delivery lifecycle. The group focuses on:

• Automated Pipeline Governance: Wiring compliance standards (such as NIST SP 800-53 Rev. 5, OSCAL, and NIST SSDF) directly into CI/CD pipelines to generate real-time compliance evidence.

• Agentic AI & Spec-Driven Security: Utilizing AI agents, spec-driven development (SDD), and automated testing to write, verify, and monitor secure code within approved execution boundaries, anchored by an enterprise AI Factory and reference architecture. 

• Software Factories & Shared Platforms: Defining platform engineering reference architectures for PaaS/IaaS landing zones, control inheritance, containerized deployment models, and a secure software supply chain.

• Continuous Monitoring & Risk Management: Implementing dynamic vulnerability management SLAs (e.g., CISA BOD 26-04, EVSS), real-time risk dashboards, and runtime observability.

• Cultural Transformation: Empowering product teams with automated guardrails while educating executive leadership and Authorizing Officials (AOs) on risk-based decision-making over static paperwork, supported by strategic budget alignment, targeted automation, and workforce development.

If you’re interested in attending, please reach out to Elizabeth Wyckoff Melore at ewyckoff@atarc.org