Security Compliance as Code
summary
Built a Common Controls Framework that funnels 2,500 to 350 controls into a baseline of about 100–140 controls so teams add only 10–50 extra controls for PCI or FedRAMP; open‑sourced in 2018. A four‑layer automation platform (infrastructure, integrations, rules engine, visualization) links a data catalog to continuous code checks, near‑real‑time dashboards and self‑service control onboarding, cutting repetitive evidence work that once cost 40–80 hours a quarter via a driver‑subscriber model for centralizing implementations.
AI-written summary · about
chapters (7)
- 0:00Introduction to compliance journey
- 3:31Building common controls framework
- 6:00Compliance as source code vision
- 9:09Four-stage automation platform
- 13:20Engineering platform benefits
- 15:05Resilience automation during pandemic
- 16:31Resources and Q&A start
related talks
33mCompliance as Code - Lessons Learned From Regulated Organizations
54mCompliance-As-Code For API Security
32mThe One About Controls
05mHow To Automate Compliance If You Aren't Chuck Norris
32mIntroduction to CDD and Security Centric System Design
03mCompliance-As-Code For API Security - session preview
36mBuilding Security Frameworks Into Your CI/CD Pipelines
42mSolving for DevOps Auditors with Automated Compliance