---
name: devsecops-devsecops-cheat-sheet
title: DevSecOps cheat sheet
description: Use this cheat sheet as a quick reference for the key recommendations when you adopt Continuous Delivery DevSecOps. Each item has a short statement and a link to the corresponding documentation.
last-updated: 2026-11-03
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/devsecops?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# DevSecOps cheat sheet
{: #devsecops-cheat-sheet}

Use this cheat sheet as a quick reference for the key recommendations when you adopt Continuous Delivery DevSecOps. Each item has a short statement and a link to the corresponding documentation.
{: shortdesc}

## Get started
{: #cheat-sheet-get-started}

| Recommendation | What to do | Learn more |
|----------------|------------|------------|
| Use supported pipeline versions | Use the `v10` or `v11` pipeline version. The `v9` version is no longer supported. | [Select a specific version branch or tag](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-select-version&format=markdown), [Improving compliance pipeline performance](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-conc&format=markdown) |
| Adopt the complete DevSecOps spectrum | Set up continuous integration (CI), continuous deployment (CD), and continuous compliance (CC) together, rather than a subset. | [CI pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-ci-pipeline&format=markdown), [CD pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cd-pipeline-overview&format=markdown), [CC pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-cc-pipeline&format=markdown) |
| Follow the toolchain best practices | Start from the practices that each reference toolchain (CI, CI for IaC, CD, CC) already implements. | [Best practices for DevSecOps toolchains](https://cloud.ibm.com/docs/devsecops?topic=devsecops-practices-toolchains&format=markdown) |
| Onboard your own application | Bring your application to DevSecOps with the inferred pipeline configuration instead of writing the configuration from scratch. | [Bringing your own app to DevSecOps](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-apps-byoa&format=markdown), [Creating a pipeline with Inferred DevSecOps configuration](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-inferred-pipeline-configuration&format=markdown) |
| Use a PR pipeline | Run the PR pipeline on every pull request to catch issues before merge. | [Pull request pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pr-pipeline&format=markdown) |
{: caption="Get started" caption-side="top"}

## Evidence and traceability
{: #cheat-sheet-evidence}

| Recommendation | What to do | Learn more |
|----------------|------------|------------|
| Reuse evidence | Opt in to evidence reuse so that PR and CI pipelines skip scans and tests when the content did not change. | [Reuse of evidence across PR and CI pipelines](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-evidence-reuse&format=markdown) |
| Use Object Storage as the evidence locker | Store evidence only in IBM Cloud Object Storage buckets. | [Using IBM Cloud Object Storage buckets as an evidence locker](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-bucket-evidence&format=markdown), [Configuring IBM Cloud Object Storage for storing evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-config&format=markdown) |
| Collect evidence in the PR pipeline | Set `collect-evidence-in-pr` to collect evidence and manage issues for pull requests. | [Enable evidence collection in PR pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pr-pipeline&format=markdown#cd-devsecops-pr-evidence-collection) |
| Gate deployments on evidence | Know why a deployment is blocked, and configure evidence checks for your deployment topology. | [Validating evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-evidence-checks-validation&format=markdown) |
| Keep peer review on | Keep `peer-review-compliance` set to `1` so that merged pull requests are checked for peer review. | [Peer review compliance](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-peer-review&format=markdown) |
| Enable PR traceability | Set the `deployment-traceability` flag so that merged PRs are labeled with the environment they were deployed to. | [Enabling deployment traceability](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cd-pipeline-overview&format=markdown#enable-traceability) |
| Automate change management | Let the CD pipeline create, approve, and close change requests with the deployment evidence attached. | [Automated change management](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-change-management&format=markdown) |
| Generate a software bill of materials | Produce SBOMs for each built microservice and keep them with the evidence. | [Software Bill Of Materials](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-sbom&format=markdown) |
{: caption="Evidence and traceability" caption-side="top"}

## Security and compliance
{: #cheat-sheet-security}

| Recommendation | What to do | Learn more |
|----------------|------------|------------|
| Manage issues | Set the `incident-assignees` and `incident-labels` properties in the CI and CC pipelines so that incident issues have owners and labels. | [Assigning incident issues to users](https://cloud.ibm.com/docs/devsecops?topic=devsecops-assign-incident-issues&format=markdown), [Labeling incident issues](https://cloud.ibm.com/docs/devsecops?topic=devsecops-incident-issues&format=markdown#label-incident-issues), [Pipeline parameters](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parm&format=markdown) |
| Track due dates on issues | Use due dates and custom grace periods on incident issues, and extend them only through the documented process. | [Managing due dates for incident issues](https://cloud.ibm.com/docs/devsecops?topic=devsecops-incident-issues&format=markdown#incident-issue-due-date-setting), [Extending the due date of an incident issue](https://cloud.ibm.com/docs/devsecops?topic=devsecops-incident-issues&format=markdown#due-date-postpone) |
| Close fixed issues automatically | Keep `opt-in-auto-close` at its default of `1` so that issues close when the vulnerability is no longer detected. | [Use case 4: automatically closing fixed issues](https://cloud.ibm.com/docs/devsecops?topic=devsecops-incident-issues&format=markdown#incident-issue-uc4) |
| Auto-remediate security issues | Turn on auto-remediation in the CC pipeline (`opt-in-cra-auto-remediation`) so that fix PRs are opened for vulnerable packages. | [Automatically remediating vulnerabilities](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cra-scans&format=markdown#cd-devsecops-auto-remediate) |
| Pick your scanners | Review the supported scanning tools and configure the ones that fit your stack. | [Supported scanning tools](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-supported-scanning-tools&format=markdown), [Configuring detect-secrets scans](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-detect-secrets-scans&format=markdown) |
| Sign your artifacts | Configure signing properties so that the CI pipeline signs images, and sign non-image artifacts too. The CD pipeline blocks unsigned artifacts. | [Generating a GPG key](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-image-signing&format=markdown), [Signing non-image artifacts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-artifacts-verify&format=markdown) |
| Vault your secrets | Keep secrets in a vault and link them to the toolchain, rather than pasting values. | [Managing secrets in your toolchains](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-toolchains-secrets-new&format=markdown), [Using secrets integrations in your toolchains](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-toolchains-secrets&format=markdown) |
| Apply least-privilege access | Grant the Pipeline Administrator and Pipeline Runner roles only the IAM access that each role needs. | [Managing IAM access for cloud resources](https://cloud.ibm.com/docs/devsecops?topic=devsecops-iam-permissions&format=markdown) |
{: caption="Security and compliance" caption-side="top"}

## Customization and operations
{: #cheat-sheet-customization}

| Recommendation | What to do | Learn more |
|----------------|------------|------------|
| Customize processes in a controlled way | Use `one-pipeline-config-repo` for your pipeline configuration and custom scripts. Reuse the common script tools that are provided in the compliance base image. | [Working with default and custom scripts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-advanced-pipelines-customization&format=markdown#default-and-custom-scripts), [Understanding Commons Scripts in DevSecOps](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-common-scripts-revise&format=markdown) |
| Organize your repositories | Plan your application, shared configuration, inventory, and issues repositories before you create toolchains. | [DevSecOps repositories considerations](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-advanced-pipelines-customization&format=markdown#repo-considerations-devsecops) |
| Choose a deployment model | Decide between push-based and pull-based deployment for your clusters. | [Deployment models](https://cloud.ibm.com/docs/devsecops?topic=devsecops-deployment-model&format=markdown) |
| Manage the inventory | Promote inventory changes through branches and partition the inventory for the CC pipeline when you have many artifacts. | [Understanding inventory for DevSecOps](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-inventory&format=markdown), [Partitioning inventory for CC pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-partition-inventory-cc-pipeline&format=markdown) |
| Develop pipeline changes in development mode | Test `.pipeline-config.yaml` changes with the simplified pipeline. Development mode skips compliance tasks and collects no evidence, so switch back for real runs. | [Running pipelines in development mode](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-devmode&format=markdown) |
| Run several apps from one toolchain | Configure the CI and PR pipelines for multiple application repositories. | [Configuring multiple apps on one CI toolchain](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-multiple-apps&format=markdown) |
| Get notified | Add Event Notifications to the toolchain and set `event-notifications` to `1`. | [Event Notifications for DevSecOps pipelines](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-configure-en&format=markdown) |
| Troubleshoot with debug mode | Turn on `pipeline-debug` to get more detail when a run fails. | [Pipeline parameters](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parm&format=markdown#pipeline-parm-pipeline-debug), [Troubleshooting](https://cloud.ibm.com/docs/devsecops?topic=devsecops-troubleshoot-devsecops&format=markdown), [FAQ](https://cloud.ibm.com/docs/devsecops?topic=devsecops-faq_devsecops&format=markdown) |
{: caption="Customization and operations" caption-side="top"}