--- title: "The SDLC compliance surface: what federal frameworks actually require from your build pipeline" url: https://daily.dev/posts/the-sdlc-compliance-surface-what-federal-frameworks-actually-require-from-your-build-pipeline-zsyah1vrp source_url: https://earthly.dev/blog/federal-compliance-sdlc-requirements/ type: article source: "Earthly" published: 2026-03-09T22:37:04.995Z updated: 2026-03-09T22:37:30.977Z tags: ["cicd", "containers", "devsecops", "sbom"] reading_time: 17 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The SDLC compliance surface: what federal frameworks actually require from your build pipeline **[Earthly](https://daily.dev/sources/earthly)** · 17 min read · 0 upvotes · 0 comments ## Summary A detailed technical breakdown of what US federal compliance frameworks (EO 14028/NIST SSDF, DISA STIGs, CMMC Level 2/NIST 800-171, FedRAMP, FISMA, ITAR) actually require from software build pipelines. The post catalogs specific controls per framework with their technical implementations, then synthesizes cross-cutting SDLC themes: SBOM generation and validation, security scanning enforcement (SAST/SCA/container/IaC), container image hardening, build provenance and artifact signing, secret scanning, version control and change management, testing evidence, and continuous compliance evidence collection. Key highlights include CMMC's five 5-point controls that cannot be deferred via POA&M, DISA Container Image Guide requirements mapping to Dockerfile/Kubernetes practices, and the industry direction toward continuous machine-readable evidence rather than periodic manual audits. The post concludes with a pitch for Earthly Lunar as a guardrails engine addressing these requirements. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The compliance tax: what it actually costs to ship software to the U.S. government](https://daily.dev/posts/the-compliance-tax-what-it-actually-costs-to-ship-software-to-the-u-s-government-l6l9q0ucg) · Earthly · 0 upvotes · 0 comments - [Cloud Database Security Engineering and SDLC](https://daily.dev/posts/cloud-database-security-engineering-and-sdlc-wllqawe9w) · SingleStore · 0 upvotes · 0 comments - [Multicloud Compliance: Frameworks, Controls, and Evidence](https://daily.dev/posts/multicloud-compliance-frameworks-controls-and-evidence-lgu278ztw) · Spacelift · 0 upvotes · 0 comments --- Tags: [#cicd](https://daily.dev/tags/cicd), [#containers](https://daily.dev/tags/containers), [#devsecops](https://daily.dev/tags/devsecops), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/the-sdlc-compliance-surface-what-federal-frameworks-actually-require-from-your-build-pipeline-zsyah1vrp)