Panel Discussion: Ask an Auditor Anything: DevOps Compliance
summary
A toolkit called DevOps Audit Defense Toolkit maps classic controls (separation of duties, change management, management oversight) to DevOps evidence and recommends a three‑year migration: year 1 dual evidence, year 2 hybrid, year 3 full DevOps evidence. It emphasizes audit logs, file‑integrity checks, CI pipelines, and configuration managers like Puppet deployments as verifiable controls, warns a typical vendor evidence request costs ~40‑hour evidence hit, and advocates continuous governance and sprint review gates to make audits repeatable.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:40Who is this panel
- 1:23DevOps and audit
- 2:25Simon
- 3:26What motivates an auditor
- 4:41The bad auditor
- 5:20Working together
- 7:05Separation of Duties
- 9:00Change Management
- 10:42Biggest surprise
- 11:59DevOps Audit Defense Toolkit
- 13:06Theres a lot of hope
- 13:59Documentation and artifacting
- 17:02Evidence gathering
- 19:39Focus on audit
- 21:39Lean and agile
- 23:17Closing remarks
related talks
01h 10mAuditors' Workshop: What You’ve Wanted to Ask an Auditor, but Were Afraid To Ask
29mAn Unlikely Happy Couple - DevOps and IT Audit?
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
34mDevOps from an Auditor’s Perspective: A Meaningful Partnership to Drive Business Transformation
42mSolving for DevOps Auditors with Automated Compliance
30mProve it! The Last Mile for DevOps in Regulated Organizations
22mPutting Governance Into your DevOps Processes
58mImplementing compliance, assurance, and auditing on