anyone have recommended stacks/tooling to be able to integrate security day 1 in development. (CI/CD, continuous monitoring etc all geared towards NIST & ATO?)

anyone have recommended stacks/tooling to be able to integrate security day 1 in development. (CI/CD, continuous monitoring etc all geared towards NIST & ATO?) Looking to impeded business/mission feature development as little as possible, but security is just as important.