CI/CD & DevOps

DevOps is a cultural and technical approach that combines development and operations teams to deliver software continuously, safely, and reliably. For regulated environments, DevOps practices must balance speed with compliance and quality requirements.

What is DevOps?

DevOps is the collaboration of development and operations teams, integrated processes, and tooling to deliver software-driven innovation continuously.

DevOps Adoption Paths

The DevOps lifecycle consists of six adoption paths that allow teams to focus on immediate needs and grow from there:

DevOps Principles

Culture

• Collaboration: Break down silos between Dev, Ops, Security, and QA
• Shared Responsibility: Everyone owns quality and reliability
• Learning Culture: Blameless post-mortems, continuous improvement
• Customer Focus: Deliver value continuously

Automation

• Build Automation: Consistent, repeatable builds
• Test Automation: Fast feedback on quality
• Deployment Automation: Reliable, frequent deployments
• Infrastructure Automation: Consistent environments

Measurement

• Lead Time: Time from commit to production
• Deployment Frequency: How often you deploy
• Change Failure Rate: Percentage of failed deployments
• Mean Time to Recovery: Time to restore service

DevOps Pipeline

Pipeline Stages

Environments

Environment Parity

• Use identical configurations across environments
• Use same deployment process for all environments
• Test deployments before production
• Detect environment-specific issues early

DevOps for Regulated Industries

Compliance Integration

FDA/HIPAA Considerations

• Maintain Design History File (DHF) artifacts
• Document validation activities
• Preserve evidence of testing
• Control access to production deployments
• Audit all changes and deployments

Pipeline Compliance Controls

# Example: Compliance-aware pipeline
stages:
  - build
  - test
  - security
  - compliance-check
  - deploy

compliance-check:
  stage: compliance-check
  script:
    - ./scripts/verify-test-coverage.sh
    - ./scripts/verify-approvals.sh
    - ./scripts/generate-audit-report.sh
  artifacts:
    paths:
      - audit-report.pdf
      - compliance-evidence/

Key Metrics (DORA)

The DevOps Research and Assessment (DORA) metrics measure DevOps performance:

DevOps Tools Ecosystem

CI/CD Platforms

Infrastructure & Deployment

Monitoring & Observability

Best Practices

Do

• Automate everything possible
• Keep pipelines fast (< 10 minutes ideal)
• Deploy frequently in small batches
• Monitor everything
• Practice infrastructure as code
• Implement feature flags
• Conduct blameless post-mortems

Don't

• Skip tests to deploy faster
• Make manual changes to production
• Ignore security in the pipeline
• Create environment-specific code
• Deploy without rollback capability
• Accumulate technical debt in pipelines

Related Resources

• Continuous Integration
• Continuous Delivery
• Infrastructure as Code
• DevSecOps
• Automated Testing
• Microsoft Playbook: CI/CD

Compliance

This section fulfills ISO 13485 requirements for software validation (4.1.5), design changes (7.3.7), control of production (7.5.1), control of records (4.2.4), and traceability (7.5.3), and ISO 27001 requirements for secure development lifecycle (A.8.25), environment separation (A.8.31), change management (A.8.32), configuration management (A.8.9), and secure architecture (A.8.27).

View full compliance matrix