CI/CD for Secure Cloud-Native Deployments in Regulated Enterprises

Abstract

Regulated companies must quickly deliver software while showing that they comply with security and privacy requirements. This paper describes a DevSecOps-aligned CI/CD framework focused on secure cloud-native deployments that incorporates policy-as-code, software supply chain assurance, and runtime governance for serverless and Kubernetes environments. It integrates flexible policy controls for secure build step frameworks that include artifact signing, SBOM generation, provable provenance, vulnerability and secret scanning, active admission controls with OPA/Gatekeeper and image attestation, and compliance automation with continuous controls for HIPAA, GDPR, PCI DSS, SOC 2, and ISO/IEC 27001. Compliance is managed with a monitoring plan and enforced during build and release processes under a zero-trust framework, which incorporates least-privilege identities, just-in-time approvals, and partitioned environments. Incremental delivery methods, SLO gates on canary and blue/green deployments, and progressive delivery methods control blast radius and change failure risk. This paper also describes a control-point reference architecture defining zones for code, build, deploy, and runtime; a policy catalog that aligns technical criteria with auditable controls; and evaluation using DORA metrics, mean time to remediate vulnerabilities, policy-violation rate, and supply-chain risk scores. The healthcare and financial services case studies show a reduction in change lead time and policy drift, an increase in deployment frequency, hardening of the software supply chain, and no degradation in developer productivity.The results demonstrate that security can be shift-left and continuously verified, which allows compliant, rapid, and resilient releases even in regulated environments.