Compliance & Regulatory Standards are NOT Incompatible with Modern Development
summary
Regulations and frameworks require outcomes, not specific processes, so teams implement testing in production, observability, feature flags and CI/CD as compensating controls to satisfy audits. Example: switching from Terraform-managed IAM to SAML reduced risk but forced auditors to accept screenshots and scripted reports. Good practices surface concrete wins — SLOs and observability replace manual proofs, many teams deploy multiple times per day, you find ~80% of bugs in the immediate post-deploy window, and high performers show a ~6,570x faster lead time from commit to deploy. Aim to separate deploys from releases and deploy within an hour.
AI-written summary · about
chapters (8)
- 0:00Compliance and modern dev
- 7:58Security and regulatory frameworks
- 13:16Compliance myths debunked
- 20:20Leadership balancing compliance and speed
- 27:29Cost of slow deployments
- 33:10Regulations for better security
- 36:19Working with security and legal
- 40:17Call to action
related talks
33mCompliance as Code - Lessons Learned From Regulated Organizations
22mBridging Compliance and Innovation: A Guide for DevOps Leaders
21mSecure and Fast into Production — Modern Software Development in Regulated Environments
37mDevOps - The Automation of Compliance
44mCompliance by Design | Continuous Compliance
21mDevOps in a Highly Regulated Financial Infrastructure Company
29mCompOps (Compliance Operations): Regulatory Cultural Change
10mTest Driven Compliance