The process of generating that DevSecOps documents followed a very straightforward prompt dialog.

The full dialog sequence can be viewed here. 

The process was initiated with this ChatGPT dialog prompt:

Please provide a continuous integration / delivery pipeline (including YAML file for GitLab) and matching procedure for a DevSecOps operation that supports the SSP and associated policies and standards above.

ChatGPT responded with the following:

Here’s a complete, production-grade DevSecOps CI/CD pattern + GitLab pipeline + procedure that aligns with your SSP, POL-AC-001, PROC-AC-P01, and STD-AC-002 for Alpha Nine Fabrication, Inc.

I’ll break it into two parts:

1. GitLab CI/CD pipeline (.gitlab-ci.yml) – with security gates baked in
2. Formal DevSecOps CI/CD Procedure – written so you can drop it into your SSP annex / SOP library

The resultant documents can be found here:

                  GitLab CI/CD pipeline:  gitlab-ci.yml

                  Formal DevSecOps CI/CD Procedure: ANF-SOP-DevSecOps-CICD-001

The generated procedure was well formed and contains sections that are normally included in a procedure.  It was generated in-line in the chat dialog.  The document includes purpose, scope, roles and responsibilities and a pipeline step-by-step workflow.  This document can serve as a procedure for compliance purposes, although it would need some editing to be more complete (mainly to add in administrative elements such as expected outcomes, procedure owner, publication and review dates, signature block, etc.).  

When combined with the GitLab pipeline which is in executable YAML file format you have the basis for a full executable operational procedure.

ChatGPT also responded with the following compliance related points:

Key compliance points baked into this pipeline:

• RBAC / AC: Only authorized users (per PROC-AC-P01) can push to protected branches, configure runners, or approve prod deployments.
• Separation of duties: approval is manual and restricted to SECOPS/OIT (no self-approval by developers).
• Security gating: SAST, secrets, dependencies, IaC, container scanning, and DAST are non-optional before stage/prod.
• Auditability: All jobs, approvals, artifacts (SBOM, reports), and environment changes are logged (AU, CA).
• Change control: Each merge request + pipeline run = change record traceable to your POA&M and risk register.
• SC/SI alignment: Encrypted channels (runners -> registry), hardened runners, controlled remote access per STD-AC-002.

You can extend this pattern with GitLab Scan Execution Policies and Protected Environments for enforced security scanning and approvals. These are helpful in referencing which requirements are met by the procedure.

ChapGPT then offered:

If you’d like, next step I can:

• Turn this procedure into a ready-to-issue SOP Word doc (SOP-DEVSECOPS-CICD-001).
• Add a control-mapping table: CI/CD steps ↔ NIST SP 800-171 ↔ CMMC Level 2 ↔ your internal doc IDs.

When responded with yes please, ChaptGPT responded with:

Excellent — I’ll now generate a formal, CMMC-aligned Word document for:

SOP-DEVSECOPS-CICD-001 – Secure CI/CD and Release Management Procedure

This will include:

• Formal header (CUI, version, approvals)
• Purpose, Scope, Roles, and Responsibilities
• Step-by-step CI/CD workflow (aligned to the GitLab YAML)
• Control mapping (CI/CD → NIST SP 800-171 / CMMC L2 / ANF internal policy IDs)
• Audit, monitoring, and evidence retention
• Signature/approval section

Before I generate the Word file, please confirm one detail:

Would you like the control-mapping table at the end to show:

1. Full mapping — NIST 800-171 Rev 2 + CMMC L2 + your document IDs (e.g., POL-AC-001, PROC-AC-P01, STD-AC-002),

or

2. Simplified mapping — Only NIST 800-171 control references tied to each CI/CD function?

Once you confirm, I’ll create the Word document accordingly.

A response of “Please generate the formal CMMC-aligned Work document with Full mapping table.” resulted in:

The SOP-DEVSECOPS-CICD-001 – Secure CI/CD and Release Management Procedure for Alpha Nine Fabrication, Inc. has been successfully generated with full NIST 800-171 Rev 2 / CMMC L2 control mapping.

You can download it here:

SOP-DEVSECOPS-CICD-001_Secure_CICD_Procedure.docx

This version of the document added the administrative bits referenced above, however the Step-by-Step procedure in the initial document was replaced with a CI/CD Overview that although informative from an operational procedure point of view was a step back.  In addition, ChatGPT added a Control Mapping Table, which is very helpful for demonstrating compliance related to the procedure.

Note the Supporting ANF Documents column in the Control Mapping Table that ChatGPT generated.  The documents listed in this column are a combination of documents that were subjects of prior ChatGPT chat dialogs in the sequence used for these blog articles with some additions created by ChatGPT.  These creations are logically needed for a complete control mapping table added in order to provide a more comprehensive control mapping (thank you ChatGPT!). 

Should these references to non-existing documents be considered so called AI hallucinations?  Form a Compliance Analyst’s perspective, I welcome these inclusions and view them as suggestions of items needed for the compliance program.  From that point of view, these inclusions are appreciated additions. 

By combining the two generated procedure documents, in the vein of “some assembly required”, with a few quick edits, I produced a final draft document suitable for internal review and approval, located here: 

ANF-SOP-DEVSECOPS-CICD-001.pdf.

It took a little over 20 minutes to get to this point in the document generation process.  Considering the production of two useful documents (one procedure, one executable code file) and that in order to write such documents manually would require the better part of a day plus to produce (constructing the control mapping table for instance could easily take a few hours to research the control requirements and collect the list of supporting documents), using AI to generate these types of documents has very high value.

Continuing with the chat dialog sequence, two more documents were generated:

STD-DEVSECOPS-003_GitLabRunnerSecurityStandard.docx

  CHKL-DEVSECOPS-003A_GitLabRunnerHardeningChecklist.xlsx

The GitLab Runner Security Configuration standard defines the requirements for executing (running) the CI/CD pipeline process implemented in the GitLab CI/CD pipeline YAML file referenced above. 

The Runner Hardening Compliance Checklist provides the list of compliance evidence to be checked related to the CI/CD pipeline build process. 

Note that in the checklist Evidence column, there are references to evidence that is produced by running various tools including Nessus scans, CIS-CAT reports, etc.  As with entries generated by ChatGPT for the control mapping table above, these were creatively added by ChatGPT. 

In a real-world setting, you would substitute the tools locally used, or use these are suggestions for adding tools to the mix. 

Also note that the use of the pipeline and the additional tools suggested by ChatGPT could be added as test cases (see the test case blog here), to further complete the compliance program implementation.