Yes, if you keep the right records. DORA's pervasive security page notes that automating security activities in the deployment pipeline lets you generate evidence on demand that controls are operating, which helps auditors and assessors. The work is deciding what to retain and making it retrievable.
What DORA says
The page says much of security work can be automated and placed in the deployment pipeline, and that by automating these activities you can generate evidence on demand to demonstrate that controls are operating effectively. It names auditors, assessors and anyone else in the value stream as the audience.
This is a general engineering claim. Whether a given record satisfies a given framework is a question for your auditor and your compliance lead, not for this post.
What a pipeline can record
| Control | Pipeline record | Useful fields |
|---|---|---|
| Code review before merge | Pull request approvals | Reviewer, time, commit |
| Dependency vulnerability check | Scan result per build | Tool, version, findings, policy outcome |
| Blocking rule | Gate decision | Rule applied, pass or fail, override and approver |
| Change traceability | Link from ticket to commit to deployment | IDs and timestamps |
| Component inventory | SBOM per build | Components and versions |
| Rollback ability | Deployment history | Who, when, what version |
The retention problem
Many CI systems expire run history after a set period. Evidence that disappears before the audit window is not evidence. Check your retention setting and export what you need. Our post on exporting security metrics before CI history expires explains the pattern.
Steps to make it work
- List the controls you will be asked about, using your auditor's request list from last cycle if you have one.
- For each, name the pipeline record that shows it operated.
- Store the records outside the CI system, with dates, in a place with controlled access.
- Keep the override log. An audit often asks who bypassed a control and why.
- Test retrieval. Pick a past release and try to assemble its evidence in an hour.
- Record the tool version and policy version used for each scan, so results are reproducible.
What not to claim
Records show that a check ran, not that it was sufficient. Describe the evidence accurately. Do not describe a program as certified or attested unless an independent party has issued that result.
Link to delivery metrics
The same data feeds DORA style metrics. Gate outcomes, override counts and deployment times serve both the audit and the improvement review, so the effort is not duplicated.
Quick check
How long should we keep pipeline evidence?
Ask your auditor and your policy owner. Keep at least the full audit window plus a margin.
Do screenshots count?
Often less well than system-generated logs with timestamps. Prefer exports that can be regenerated.
Try it yourself
Click through it at your own pace, or open it full screen.
See how technical findings are mapped to framework controls, which is the step between a pipeline record and an evidence request.
How Safeguard fits
Safeguard offers compliance and evidence automation, SBOM generation and policy gates, which help collect and organize pipeline records. Try a free scan at gold.safeguard.sh/scan.
Sources
- DORA, Pervasive security: https://dora.dev/capabilities/pervasive-security/
Last reviewed: 19 October 2026.
