DevSecOps Practice Hub

Continuous Compliance

Produce control evidence automatically and continuously instead of during audit sprints.

IntermediateComplianceGovernance

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Release Approval controls, artefact promotion and provenance.
  • Operate Runtime security, secrets rotation and configuration reconciliation.
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

Continuous compliance maps each control to an automated check that emits dated, machine-readable evidence, so audit is a query rather than a project.

Why it matters

Point-in-time audits say nothing about the other 364 days, and manual evidence collection is expensive and error-prone.

How it works

  1. 01Each control is mapped to a technical check.
  2. 02Checks run on a schedule and store dated results.
  3. 03Exceptions are recorded with justification, owner and expiry.

Common tools

OpenSCAPOpen Policy AgentProwlerKubernetesAWSLinuxRed Hat

Implementation examples

yamlScheduled compliance evidence
compliance_evidence:  stage: compliance  rules:    - if: $CI_PIPELINE_SOURCE == "schedule"  script:    - prowler aws --compliance cis_2.0_aws --output-formats json-ocsf    - ./scripts/upload-evidence.sh output/  artifacts:    expire_in: 400 days    paths: [output/]
Retention beyond the audit period is what makes the evidence usable.

Best practices

  • Map controls to checks explicitly.
  • Give every exception an expiry.
  • Retain evidence for the full audit window.

Common mistakes

  • Collecting evidence only when the auditor asks.