The DevSecOps Playbook: A step-by-step guide to implementing DevSecOps

Paul McCarty opens by arguing that DevSecOps has been diluted by vendor messaging that reduces it to CI/CD tooling with some scanning added. He points to engineers who often deploy straight to cloud accounts, security teams still running questionnaire-driven reviews, and thin operations staff in scale-ups as the persistent gap. He treats DevSecOps as a collaborative methodology built on DevOps, distinct from application security, which he describes as a team focused on code testing.

The core of the talk walks through his open-source DevSecOps Playbook. Its tasks sit in five domains: development environment, source code management, CI/CD and automation, deployment environments, and organization. Each task has a priority from one to three and a difficulty rating based on the people and time it takes. Examples include pre-commit scanning and moving secrets out of .env files. An addendum maps tasks to compliance frameworks such as ASVS, NIST SSDF and Australia's ISM, so common questionnaire items can be answered in advance. He also offers advice on starting a program: map applications to their owners, find willing collaborators, and pick measurable goals.

He closes with the roadmap: a companion document with deeper guidance, more framework mappings, and sorting by priority and difficulty. He invites contributors to the public repository. The takeaway is to treat the playbook as an adaptable checklist sized to an organization's own structure.