expressed as code.” c. CREATE A SINGLE, SHARED SOURCE CODE REPOSITORY FOR OUR ENTIRE ORGANIZATION i. Firm-wide shared source code repository is powerful way to share local discoveries to the entire organization pipeline tools 5. Monitoring and analysis tools 6. Tutorials and standards ii. Google – Single repository with over 1B files and over 2B SLOC, over 25K engineers for every Google property d. SPREAD KNOWLEDGE work i. Make security part of everyone’s jobii. Integrate preventative controls into our shared repository iii. Integrate security with our deployment pipeline iv. Integrate security with our telemetry

& secure c. CREATE OUR SINGLE REPOSITORY OF TRUTH FOR THE ENTIRE SYSTEM i. ALL parts (code & environments) of the system are shared in a version control repository ii. Version control is for everyone without accompanying automated tests. Spread Testing Grouplet team approach. Google – single, share repository of billions of files. 50% of code is changed each month. 40K code commits/day, 120K automated

Program-specific Log Storage and Retrieval Service 2. Service Mesh 3. Program-specific artifact repository 4. Runtime Behavior Analysis Artificial Intelligence (AI) service 5. DCAR for the hardened https://www.csiac.org/podcast/dod-enterprise-devsecops-initiative/ DoD Centralized Container Source Code Repository (DCCSCR) https://dcar.dsop.io/ DSOP Group Workspace https://dccscr.dsop.io/dsopDCCSCR Project

requirements managed on the backlog?  Are requirements/user stories/backlogs maintained in a central repository accessible by a broad user base, and is content shared at user forums?  Does the product  How are program risks managed? Is there a central (single) risk repository? Do stakeholders have access to this repository and can they contribute to it? How quickly are risk mitigations implemented

Created a self-improvement project  2 week iterations, planning and demos  Put everything into a repository (configurations, scripts, etc.) Infrastructure as Code  Turned over repeatable and automatable