Compliance as Code
Compliance as Code means translating regulatory requirements (ISO 27001, GDPR, nFADP, EMBAG) into machine-readable test scripts that run automatically and continuously in the CI/CD pipeline or infrastructure. This transforms compliance from a periodic audit into a permanent system state.
The alternative — manual checklists and annual certification projects — is error-prone, expensive, and always reacts too late.
Core Concept
- Policy as Code: Security and compliance rules are described in languages such as OPA (Open Policy Agent), Rego, or AWS Config Rules.
- Shift Left: Compliance checks happen at code commit, not at certification time.
- Audit Trail: Every check is versioned, reproducible, and traceable.
- Continuous Compliance: Dashboards show compliance status in real time, not just once a year.
Implementation
- Requirements Inventory: Translating regulatory requirements into testable statements (e.g. All S3 buckets must be encrypted).
- Tool Selection: Open Policy Agent (OPA) for Kubernetes, Checkov for Terraform, AWS Config / Azure Policy for cloud resources.
- Pipeline Integration: Compliance tests run on every pull request and block deployment on violation.
- Reporting: Automated reports for auditors, documenting compliance status at any point in time.
Focus: From Project to Permanent State
Compliance is no longer manufactured but permanently measured. This massively reduces the effort required for recertification.
FAQ
Does Compliance as Code replace the human auditor?
No. It replaces manual, repetitive controls. Complex risk assessments and organisational measures still require human judgement. Compliance as Code does, however, create the foundation for efficient, evidence-based audits.
What about compliance requirements that are difficult to automate?
Organisational measures (training, responsibilities) remain manual. Everything technical — configurations, access rights, encryption — is automatable.
Reference Guide
- Open Policy Agent: The standard for Policy-as-Code. openpolicyagent.org
- Checkov: Static analysis for IaC. checkov.io
- NIST Cybersecurity Framework: nist.gov/cyberframework