See Marcelo and I in the video below!
In both industry and government, independent verification and validation (IV&V) testing is an often-targeted component for automation. DevOps team members should use Automate and Compliance Profiles to automate acceptance testing for applications and improve on their regulatory and compliance position.
NIST Special Publication 800-123 details three information security objectives often identified using the acronym CIA: confidentiality, integrity, and availability. In the US Federal Government, IT Leadership pushed for more IV&V testing of their systems, as well as automating said testing, and this talk aims to demonstrate one approach we have found to solve these problems.
ChefConf 2019, Seattle, WA, w/ Marcelo Zambrana

Comments