“Deutschland-Stack” for government IT

What “DevSecOps only” actually means

31.03.2026

Consulting, Cybersecurity, DevOps, Engineering, Future eGovernment, Industries, Software Development

On March 18, 2026, the German IT Planning Council, the central policymaking body for the digitalization of public administration, adopted the “Deutschland-Stack.” This federal framework establishes ten architectural principles for all government IT in Germany, from the federal level to local municipalities.

One of these principles stands out for its clarity: “DevSecOps only.” This marks the first time agile, security-integrated software development has been established as a binding standard. By 2028, concrete implementation plans for all federal levels in Germany will be available.

What lies behind the DevSecOps mandate?

Rather than postponing security checks until the end of the project, DevSecOps integrates them directly into the development pipeline. Thus, security checks, automated tests, and Infrastructure as Code become part of everyday development. The Deutschland-Stack explicitly cites OWASP (the Open Web Application Security Project) as a guideline and Policy as Code as a standard principle.

In short: Security should be built in from the beginning, not demonstrated at the acceptance stage.

This is not a gradual adjustment. German government agencies that still use the V-Model XT or traditional, phase-based models must undergo a structural transformation of their development and acceptance processes.

Regulation meets a challenging reality

The resolution establishes a standard. Implementation falls to the authorities. There, the new requirement faces the challenging reality that approximately 78 percent of IT budgets in Germany’s public administration are allocated to maintaining and operating existing systems. There is little room left for developing new infrastructures.

At the same time, pressure is mounting from another direction. The German NIS-2 Implementation Act, which took effect on December 6, 2025, with no transition period, explicitly requires security in the development and procurement of IT systems. Those who do not implement DevSecOps risk a compliance gap, which will become apparent during upcoming audits and procurement procedures.

Added to this is the shortage of skilled workers. Public administration in Germany currently lacks around 39,000 IT specialists, and this number is growing. DevSecOps experience is one of the most in-demand skills on the market and correspondingly difficult to develop internally.

Where to start

The good news is that: DevSecOps can be implemented in stages. The first federal states in Germany are demonstrating how it’s done. For example, Lower Saxony uses the Scaled Agile Framework (SAFe) with Program Increment Planning for up to 125 participants. The “V-Modell XT Bund” has been modified so that work can be carried out entirely on a Scrum basis. This approach is effective, but it requires structure, experience, and reliable verification artifacts.

Pragmatic entry points for government agencies:

Build a CI/CD pipeline with automated security checks: SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) tools can be integrated into existing build processes step by step without overhauling the entire infrastructure.
Establish test automation as the backbone: Automated regression tests lay the foundation for shorter release cycles and provide the test logs required by procurement and audit processes.
Involve development partners with Gov-IT experience: Within the scope of procurement law, external service providers can set up agile development and testing processes with documentation that fits into EVB-IT contexts and makes acceptance tests audit-proof.

An initial DevSecOps building block does not replace a comprehensive security concept. However, it establishes a development foundation upon which all subsequent measures can be built. In its position paper on the Deutschland-Stack, Bitkom calls for exactly this: “Standardized development and test environments, API catalogs, reference architectures, and automated processes” are prerequisites for a consistent developer experience.

If you’d like to know what an initial DevSecOps building block might look like in your agency, please speak with our Gov-IT team. We will guide you from conception through implementation in compliance with procurement regulations and with verifiable quality assurance.

“Deutschland-Stack” for government IT

What lies behind the DevSecOps mandate?

What lies behind the DevSecOps mandate?

Regulation meets a challenging reality

Where to start

FAQ

Sources

Get in touch with us!