Apply compliance framework to your project

Use this procedure to apply the SHIP-HATS compliance framework to a project and control the level of security and compliance enforced in your pipeline.

Before you begin

• Understand what each compliance level includes. See Compliance framework levels.

Steps

1. Follow the GitLab instructions to Apply a compliance framework to a project.

2. Optional: Set your desired compliance level in project CI/CD variables:

   • CF_LEVEL=1 — basic static scans
   • CF_LEVEL=2 — Level 1 + DAST and deployment security gating
   • CF_LEVEL=3 — Level 2 + sign and verify artefacts
   • CF_LEVEL=4 — Default; Level 3 + SLSA L1/L2 provenance

Related topics

• Advanced compliance framework features