Question

A financial services company is adopting the Cloud Adoption Framework (CAF) to govern their Azure migration. Their development teams release code multiple times per day using Azure DevOps pipelines. Leadership wants security embedded into the software delivery lifecycle so that vulnerabilities are caught before deployment, without creating a separate late-stage security gate that slows releases. As the cybersecurity architect, which approach best aligns with CAF's Secure methodology and DevSecOps principles?

Accepted Answer

Integrate automated security controls throughout the pipeline (IaC scanning, SAST, dependency and container image scanning) with policy-as-code enforcement, treating security as a shared continuous responsibility across dev and ops.

Answer

Establish a dedicated security review board that manually approves every production release after functional testing is complete.

Answer

Run a comprehensive penetration test quarterly and remediate all findings during a scheduled maintenance window each quarter.

Answer

Grant the security team direct write access to all production subscriptions so they can remediate misconfigurations after deployment.