Compliance and Audit Readiness: The DevOps Killer?
summary
IBM's Digital Business Group runs ~75 squads managing ~150,000 webpages and deploys dozens of changes per day, so compliance shifts from gatekeeping to automation: an Enterprise Application Library registers services quickly, a global privacy assessment has fast paths for pseudo‑anonymous data, static code analysis and web crawlers like ivmf scan web run per build or daily, open‑source license scans and a package DB prevent legal surprises, audit docs live in Box folders and change history is in GitHub Enterprise, and a JSON DAR format supports automated subject access workflows.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:57About DBG
- 3:20Our challenge: compliance and audit readiness
- 3:55Challenges specific to DevOps and continuous delivery
- 4:44Application and service registration
- 6:25Business Continuity Value
- 7:24Web and application security
- 11:37Access controls
- 13:17Global Privacy Assessment
- 14:54GDPR
- 16:47DSAR
- 19:48Separation of duties
- 22:41Accessibility
- 25:29Open source checks
- 28:31Audit-ready documentation
- 29:54What we learned: the pattern
- 30:59How can you help me?
related talks
37mDevOps - The Automation of Compliance
22mBridging Compliance and Innovation: A Guide for DevOps Leaders
29mAn Unlikely Happy Couple - DevOps and IT Audit?
33mCompliance as Code - Lessons Learned From Regulated Organizations
34mDevOps from an Auditor’s Perspective: A Meaningful Partnership to Drive Business Transformation
48mWhen DevOps Meets Regulation: Integrating 'Continuous' with 'Government'
42mSolving for DevOps Auditors with Automated Compliance
32mHell Has Frozen Over: DevOps & Security