Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh: Draft SP 800-204C is Available for Comment
September 29, 2021

Draft NIST Special Publication (SP) 800-204C, "Implementation of DevSecOps for a Microservices-based Application with Service Mesh", is now available for public comment.

The newest generation of software applications—“cloud-native applications”—is a class with various functional layers, such as transaction logic, application services, infrastructure resources, policy enforcement, and monitoring of states. The unique architecture of this application class requires a more agile software life cycle paradigm, and DevSecOps (development, security, and operations) offers faster deployment and updates while integrating security throughout the life cycle.

Draft NIST SP 800-204C provides guidance for the implementation of DevSecOps primitives for a reference platform hosting a cloud-native application with the functional layers described above. The guidance also discusses the benefits of this approach for high security assurance and enabling continuous authority to operate (C-ATO).

A public comment period for this document ends on November 1, 2021. See the publication details for a copy of the document and instructions for submitting comments.

NOTE: A call for patent claims is included on page iii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Created September 28, 2021, Updated September 29, 2021