SHIP-HATS compliance framework
The SHIP-HATS compliance framework helps you automate DevSecOps practices in your pipelines.
It is based on the GitLab compliance framework and aligns with industry security standards and IM8 DevSecOps guidelines.
What you will learn
After reading this section, you will understand:
- Different compliance levels and their objectives
- Key DevSecOps practices supported by SHIP-HATS
- Where to find additional resources for further learning
Compliance framework levels
Using Compliance Framework v1.1.0 and above, you can apply different levels of compliance by setting the required CF_LEVEL variable in your project’s CI/CD variables. For advanced configuration options, see Advanced compliance framework features.
If you do not configure, CF_LEVEL=4 (highest) will be applied by default to avoid breaking changes.
The specific tools used for scanning and deployment jobs at all compliance levels are listed in the choice of tools section.
| Compliance level | Objective | Description |
|---|---|---|
CF_LEVEL: "1" |
Quickly include basic static scanning in your pipeline. | - Includes jobs from .pre and static-test stages.- Minimal configuration required. - Estimated integration time: 1–3 days. |
CF_LEVEL: "2" |
Level 1 + CD scans and deployment security gating. | - Adds DAST and manual deployment jobs. - Ensures pipeline completeness with necessary tests and scans. - More configuration required. - Estimated integration time: 1–2 weeks. |
CF_LEVEL: "3" |
Level 2 + signing and verification of artefacts. | - Includes jobs to sign and verify artefacts. - Does not include SLSA L1/L2 provenance checks. - Estimated integration time: 1–3 days. |
CF_LEVEL: "4" |
Level 3 + SLSA L1/L2 provenance. | - Includes jobs to sign and verify generated attestation and SBOMs. - SLSA L1/L2 provenance checks are included. - Estimated integration time: 1–3 days. |
Key DevSecOps practices supported
The compliance framework supports the following practices:
- Software composition analysis (SCA), including dependency scanning
- SAST, DAST and container scanning
- Gating before deployment to high stake environments
- Reports generation as part of provenance
- Signing and signature verification of artefacts
- Artefact checksum validation
- Use of secure artefact repositories
We strongly recommend using the SHIP-HATS compliance templates when building your pipeline. To learn how to apply these templates and configure your project, see Apply compliance framework to your project.
All templates must follow the naming convention ship-hats-xxxxx.
💡 Using the SHIP-HATS compliance templates ensures your pipeline includes essential security checks and best practices.
Important note: Agencies using their own templates must conduct their own risk assessments and consult ACISO/MCISO.
