---
name: devsecops-devsecops-bp-secure-app
title: Best practices to deploy a secure application
description: To deploy a secure application, the DevSecOps continuous deployment toolchain contains only one pipeline with the following practices.
last-updated: 2024-02-22
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/devsecops?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Best practices to deploy a secure application
{: #practices-cd-sec-app}

To deploy a secure application, the DevSecOps continuous deployment toolchain contains only one pipeline with the following practices.
{: shortdesc}

- Change management automation to help developers, approvers, and auditors track deployments from the lens of compliance.
- Creates an evidence summary from the evidence that is collected during the associated continuous integration pipeline run for a give set of changes.
- Creates a change request in Git Repos and Issue Tracking based change management repository and adds deployment evidence.
- Uses the inventory repository to promote built artifacts to deployment environments such as  staging, and production.
- Validates the change request, and auto approves if all deployment criteria are met.
- If a change request is approved, or tagged as emergency, the pipeline deploys the image from the inventory to production.