The threats posed to software applications and information systems are constantly changing. In order to address the shifting landscape and help keep information systems in a continual state of protection, the federal government introduced the Risk Management Framework (RMF). RMF is a six-step, process focused on better securing networks and information systems by introducing the concepts of continuous system security via constant monitoring, assessing, and testing of controls. It was developed to replace the previous federal certification and accreditation process that mainly focused on prescriptive security controls and assessing the security of systems at a single point in time. At the same time, the processes and concepts by which modern software is developed, integrated and delivered is also rapidly evolving. As the federal government was moving from a prescriptive-based approach to application of security controls, a cultural shift began to happen within the software development world defined as DevOps. The term DevOps is a portmanteau of the words, development and operations, and has come to represent the goal of increasing automation throughout the software design life cycle (SDLC). The goal of DevOps is to break down the traditional separation between these two organizational units, and to deploy changes in a rapid, iterative fashion. With DevOps, the development cycle is shortened and the size of coderelease is smaller. The goal of rapid deployment may seems to run counter to the goal of security and the ability to ‘bake’ security in from the beginning.