Shaylee Czech Security Engineer

GRC Compliance Dashboard

Mapping the DevSecOps pipeline's technical capabilities to NIST, CIS, and HIPAA requirements—the language of compliance and risk management.

Overall Score

94%

4 of 4 controls implemented

NIST SP 800-53

N
100%

3 of 3 controls met

CIS Controls

C
100%

1 of 1 control met

HIPAA

H
100%

1 of 1 control met

Vulnerability & Patch Management

The CI/CD pipeline enforces shift-left security by automatically scanning for vulnerabilities in code and containers, stopping non-compliant images. CloudWatch monitoring provides centralized logging and real-time security analysis.

NIST SP 800-53: RA-5 (Scanning) CISSP Domain 6: Security Assessment
  • Snyk (SAST) checks package.json for vulnerable dependencies.
  • Trivy scans the Docker image for OS and package vulnerabilities.
  • Ansible installs all required patches and security updates on the host OS.

Principle of Least Privilege (PoLP)

Infrastructure is deployed using AWS IAM Instance Profiles, ensuring the EC2 host has zero hardcoded credentials and only the bare minimum permissions (Route 53 DNS update).

NIST SP 800-53: AC-3 (Access Enforcement) CISSP Domain 5: Identity & Access Management
  • GitHub Secrets are used for SSH, never stored on the host.
  • IAM Role is scope-limited to only update DNS records in Route 53.
  • The application containers themselves run without any cloud credentials.

Secure Baselines & Configuration

Ansible ensures the host OS is configured to a secure baseline (CIS/NIST), installing and managing the UFW firewall and preventing unapproved configuration changes.

CIS Control 7 (Configuration Management) CISSP Domain 3: Security Architecture
  • Ansible enforces the host baseline (hardening, user management).
  • Terraform defines network baselines (Security Groups) and prevents drift.
  • Docker images are defined by code (Dockerfile) and are immutable.

Data & Communication Protection

The Nginx reverse proxy enforces HTTPS/TLS 1.2+ for all public traffic and automates certificate renewal (Certbot), fulfilling HIPAA and security requirements for data in transit.

HIPAA (Technical Safeguard: Encryption) CISSP Domain 4: Network Security
  • Nginx acts as the secure edge, enforcing SSL/TLS termination.
  • Certbot ensures automatic renewal, preventing certificate expiration risks.
  • The system runs behind a public Elastic IP which is firewalled by the host UFW.