How to use GitLab's Custom Compliance Frameworks in your DevSecOps environment

This post introduces and details the creation and application of GitLab's Custom Compliance Frameworks. It explains how to define compliance requirements, create frameworks from scratch by selecting out-of-the-box controls (e.g., SAST running, Auth SSO enabled, at least two approvals), and apply them to projects. It also demonstrates how to integrate these frameworks with security policies, such as Scan Execution Policies, to enforce compliance criteria like running SAST scans. A real-world example for SOC2 compliance is provided, along with best practices for implementation.