Aligning Security Compliance and DevOps: A Longitudinal Study

2025-12-16

AI Summary

A structural tension exists between DevOps agility and security compliance requirements—particularly IEC 62443-4-1—in critical infrastructure domains. Method: This study proposes and empirically validates RefA, a security-compliance-adapted DevOps lifecycle framework. RefA introduces actionable, non-security-expert-oriented processes via standardized security activity integration, cross-functional knowledge transfer mechanisms, and organizational change support. It employs IEC 62443-4-1–driven process modeling, longitudinal empirical research, and industrial-grade DevOps adaptation techniques, validated across multiple phases at Siemens AG. Contribution/Results: RefA demonstrably enhances product teams’ autonomous capability to implement compliant DevOps practices, strengthens security-by-design maturity, and improves delivery efficiency—thereby systematically bridging the agility–compliance gap in safety-critical contexts.

Technology Category

• Application Domains: Security
• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments
• Responsible Web: Social and technical mechanisms of refusal for web technologies and applications

Abstract

Companies adopt agile methodologies and DevOps to facilitate efficient development and deployment of software-intensive products. This, in turn, introduces challenges in relation to security standard compliance traditionally following a more linear workflow. This is especially a challenge for the engineering of products and services associated with critical infrastructures. To support companies in their transition towards DevOps, this paper presents an adaptation of DevOps according to security regulations and standards. We report on our longitudinal study at Siemens AG, consisting of several individual sub-studies in the inception, validation, and initial adoption of our framework based on RefA as well as the implications for practice. RefA is a prescriptive model of a security compliant DevOps lifecycle based on the IEC 62443-4-1 standard. The overall framework is aimed at professionals, not only security experts, being able to use it on implementing DevOps processes while remaining compliant with security norms. We demonstrate how RefA facilitates the transfer of security compliance knowledge to product development teams. This knowledge transfer supports the agility aim of ensuring that cross-functional teams have all the skills needed to deliver the compliant products.

Problem

• Aligning security compliance with agile DevOps workflows
• Adapting DevOps for critical infrastructure security standards
• Transferring compliance knowledge to cross-functional product teams

Innovation

• Adapts DevOps to security regulations and standards
• Introduces RefA model based on IEC 62443-4-1 standard
• Enables cross-functional teams to implement compliant DevOps processes