{"id":1954,"date":"2022-07-29T11:21:41","date_gmt":"2022-07-29T11:21:41","guid":{"rendered":"https:\/\/tomgeraghty.co.uk\/?p=1954"},"modified":"2023-05-09T19:57:41","modified_gmt":"2023-05-09T19:57:41","slug":"the-state-of-devops-report-2022","status":"publish","type":"post","link":"https:\/\/tomgeraghty.co.uk\/index.php\/the-state-of-devops-report-2022\/","title":{"rendered":"The State of DevOps Report 2022"},"content":{"rendered":"

This year, the Google \/ DORA State of DevOps Report<\/a> dived deeper into information security. In 2021, the report highlight the importance of Secure Software Supply Chains – building in security throughout the software development cycle and supply chain.\u00a0\u00a0The research leveraged the Supply Chain Levels for Secure Artifacts (SLSA)<\/a> framework\u00a0in conjunction with NIST’s\u00a0Secure Software Development Framework (SSDF)<\/a>\u00a0to explore technical
\npractices that support the development of software supply chain security.<\/p>\n

\"\"<\/a><\/p>\n

You can see from the chart above that this year’s results show a clustering in the medium performer group. The authors consider that this may be a result of not having data from the elite performers this year, or an effect of the pandemic restricting the ability of teams to innovate practices. It’s also worth noting that the floor has risen: this years low performers perform better than last year, so whilst the ceiling is lower, the floor is higher.<\/p>\n

This year’s report showed that\u00a0high-trust, low-blame cultures focused on performance were 1.6x more likely to have above average adoption of emerging security practices than low-trust, high-blame cultures focused on power or rules.\u00a0 This reflects the difference between Safety I and Safety II approaches<\/a>, originally coined by Erik Hollnagel<\/a>. Cultures that focus largely on avoidance of risk, and implementing rules or procedures to prevent risk actually perform worse over time than cultures focussed on looking at “what went well”, not just “what went wrong”.<\/p>\n

The report showed that generative organisational cultures, as described by Westrum’s Cultural Typologies<\/a>, tend towards being higher performing. Alongside that, other drivers of high organisational performance were:<\/p>\n