DISA’s DevSecOps Citadel Software Factory advances secure software delivery

The Defense Information Systems Agency's DevSecOps Citadel Software Factory provides Department of War mission partners with a secure, cloud-based environment to build, test and assess software while integrating cybersecurity throughout the development process.

Hosted in AWS GovCloud, Citadel supports Impact Level 5 and Impact Level 6 requirements. The enterprise software factory gives software development teams a centrally managed tool chain for planning, coding, building, testing, auditing and monitoring software. By providing approved tools and security capabilities in one environment, Citadel helps teams focus on delivering mission software rather than building and maintaining their own development infrastructure.

Citadel embeds security early and continuously in the software development lifecycle. Its capabilities include automated security and compliance checks, static and runtime container scanning, vulnerability management and collaboration tools that help teams identify and address risks before applications move to production environments. Citadel supports software development and test activities, while mission partners remain responsible for deployment to their production environments and for obtaining applicable production authorizations.

The platform offers a secure, pre-approved cloud environment that can reduce time spent on infrastructure setup, manual compliance activities and platform maintenance. DISA technical experts provide onboarding and help desk support, while tenants can tailor their environments to meet mission needs.

Citadel is a core element of DISA's broader enterprise DevSecOps solution, which also includes DevSecOps innovation efforts and the DevSecOps Operational Container Scanning tool. Together, these services seek to standardize secure software delivery, reduce duplication and strengthen collaboration across the department.

As part of this enterprise approach, DISA sunset the legacy Vulcan capability Sept. 30. The transition consolidated users into Citadel, a more mature, standardized and scalable software factory with integrated security tooling. DISA DevSecOps conducted direct engagements with Vulcan user groups to support migration planning, onboarding and data preservation activities.