DevOps SOX Compliance
what you are looking for is compliance and security for containers.  There are companies that can do this out the box for you, and even though I'm not advocating for either you can see what they offer and use that as a template. 

https://www.twistlock.com/platform/container-compliance/
https://www.aquasec.com/use-cases/container-auditing-compliance/

As a HIPAA security officer and DevOps manager, I've been reviewing these processes.  The way to think of DevOps in your sense is probably the automation and culture of ship fast, fail early and fail often.  The goal is to not disrupt the pipeline from security and compliance.  Technically this looks like adding automated compliance checks in the pipeline before, during and after go live.  As automation gets built, you can replace the automation with a manual process'.  You can check out subjects like DevSecOps which is the same concept of ensuring compliance and probably closer to what you'll need to do.

here's an AWS diagram that might help https://aws.amazon.com/blogs/devops/implementing-devsecops-using-aws-codepipeline/