A Secure Framework for Continuous Compliance across Heterogeneous Policy Validation Points

Regulated compliance has become a business liabil-ity given the constant changes to the IT environments driven by the new Cloud normal enabling daily upgrades, and by the new programs related to cybersecurity. To keep pace with the changes, enterprises and auditor agencies shifted from annual audit to continuous compliance. Critical enablers of continuous compliance are standardization and automation. To achieve this, we need to treat everything as code, from the compliance artifacts to the policies and their results. Currently, Compliance as Code (CaC) is utilized to represent compliance artifacts and processes, while Policy as Code (PaC) is employed to express the logic of validating the actual state of the systems against the desired state. Although there is emerging technology for codifying compliance and policy, there are challenges that hinder the compliance digitization transformation towards continuous compliance. The first challenge is how to migrate from document-based operations to the program-based operations. The second challenge arises from the disconnect between CaC and the varied native interfaces of existing PaC solutions. Lastly, there is a concern regarding the reliability of results from end-to-end automation when replacing human-in-the-loop overseeing and guaranteeing the integrity with fully automated process. To address these challenges, we have developed a GitOps-based secure pipeline framework, seamlessly integrating compliance authoring with CaC while ensuring the secure integration of Compliance as Code and Policy as Code, protecting data integrity and preserving data traceability. In this paper, we present the details of the framework which enables end-to-end automation of compliance processes while supporting integration with various Policy Validation Points (PVPs), and showcase the evaluation of our implemented solution's reliability by testing risks such as unintentional modification of policies.