Building a Cloud-Native Compliance Culture - CeeCee O'Connor (Boston Scientific), Chuck D'Antonio
summary
A cloud-native compliance engine is built that automates traceability and validation using Concourse pipelines, PCF, Bitbucket, Pivotal Tracker, SonarQube/Veracode spikes, Compliance Masonry and the OpenControl framework. Acceptance test–driven development maps tests to requirements and every test is tagged with story IDs so audit traceability lives in pipeline artifacts. A pilot app achieves the organization’s first clean initial build run, proving the approach. Remaining gaps are making test output human-readable for auditors and deciding which pipeline gates are mandatory.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:17Who Are We?
- 1:10What about Boston Scientific?
- 2:58Day 1 @ Pivotal - Seeing The Next Right Thing
- 6:37Bring Compliance On Your Journey
- 12:07Use Your Knowledge
- 14:57Putting this into Practice
- 18:03Embedding Good Quality Practices in our Day to Day
- 20:37Tooling and Techniques
- 24:19What's Next: Our Lean Exploratory Journey
related talks
05mHow To Automate Compliance If You Aren't Chuck Norris
05mCloud-Driven Compliance for Scalable Provider Network Governance
33mCompliance as Code - Lessons Learned From Regulated Organizations
37mCompliance & Regulatory Standards Are NOT Incompatible with Modern Development..
29mAutomating Continuous Compliance for Scalable SaaS Delivery
10mTest Driven Compliance
22mBridging Compliance and Innovation: A Guide for DevOps Leaders
33mCompliance Without the Chaos: Building It Right Into Your DevOps...