Automating Industry Regulation (SoX, SoC 2) Enforcement...
summary
Shows a concrete path to embed compliance into delivery: collect CI/CD metadata into a central data lake, store policies and pipeline specs in Git, and enforce them at deploy time with OPA policy-as-code and Spinnaker pipelines with admission control. Demo enforcements include separation‑of‑duty rules that block identical approvers, process‑integrity checks that prevent removing manual approvals, and a guardrail that rejects deployments if security groups expose port 22. All decisions and scan results go into an auditable database for regulators.
AI-written summary · about
chapters (7)
- 0:00Introduction to compliance automation
- 10:34Key challenges in automation
- 20:25Policy as code approach
- 23:56Separation of duty demo
- 25:43Process integrity demo
- 27:47Port security demo
- 30:18Recommendations and resources
related talks
11mLightning Talk: Automating Industry Regulation (SoX, SoC...
24mAutomating Enterprise/Industry Regulation Enforcements During Software Delivery
36mPolicy To Pipeline: How OSPOs Can Power Regulatory Readines...
22mRethinking Risk, Governance, and Compliance Applying Automation
37mPath To Production: Sustainable Compliance In Strict Environments
15mPolicy control for Software Supply Chain
33mCompliance as Code - Lessons Learned From Regulated Organizations
30mAutomating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps