✅Compliance as Code

NEW

Also known as: Security as Code

The practice of encoding compliance controls and policies as machine-readable rules to enable automated validation, enforcement, and evidence collection.

DESCRIPTION

Compliance as Code treats regulatory and policy requirements as versioned, testable code, aligning governance with DevOps workflows. It enables automated checks in CI/CD, runtime enforcement, and continuous audit evidence generation. Tools like OPA (Rego), Chef InSpec, and Sentinel validate infrastructure, application, and data configurations. NIST’s OSCAL provides interoperable formats for control catalogs and assessments. This approach reduces drift, shortens audits, and improves traceability through tests, code review, and provenance. It requires cross-functional collaboration and mapping of legal text to control rules. Clear exceptions, waivers, and human oversight remain essential.

ALTERNATIVE DEFINITIONS

Chef (InSpec)

Compliance as Code uses human-readable, testable code to define and continuously validate compliance controls across infrastructure and applications.

Highlights human-readable tests and continuous validation using InSpec.

Source

Open Policy Agent

OPA provides a high-level declarative language (Rego) to express policy and enables policy-as-code across the stack.

Introduces declarative policy language enabling enforcement as code.

Source

NIST OSCAL

The Open Security Controls Assessment Language (OSCAL) is a set of formats for representing control catalogs, baselines, and assessment data in machine-readable formats.

Provides machine-readable compliance artifacts enabling automation.

Source

RELATED TERMS

Infrastructure as Code Open Policy Agent Rego Chef InSpec HashiCorp Sentinel OSCAL OPA Gatekeeper CIS Benchmarks Compliance Automation Audit Evidence

COMPETING TERMS

Manual Compliance Audits Traditional Compliance Documentation

KNOWLEDGE AREAS

Data Governance Data Security AI Governance Platform & Tooling Software Engineering

TARGET AUDIENCE

DevOps Engineer Security Architect Cybersecurity Engineer MLOps Engineer Data Governance Manager IT Auditor Cloud Architect IT Manager

EXTERNAL SOURCES

• Wikipedia - Policy as code
• Open Policy Agent - OPA policy-as-code documentation
• Chef InSpec - InSpec compliance testing framework
• NIST - Machine-readable compliance formats
• Kubernetes - Policy enforcement concepts in K8s

TOP QUESTIONS

What is Compliance as Code and how does it help?

It encodes controls into executable rules, enabling automated validation and enforcement. This reduces manual effort, drift, and audit friction.

Category: Relevancy

How is Compliance as Code different from Policy as Code?

Policy as Code is broader; Compliance as Code targets regulatory and standards-driven controls. In practice, tools and patterns often overlap.

Category: Comparison

Which tools are popular for Compliance as Code?

Chef InSpec, OPA/Rego, and HashiCorp Sentinel are common. They integrate with CI/CD and runtime admission controls.

Category: Tools

How does NIST OSCAL support Compliance as Code?

OSCAL standardizes machine-readable control catalogs and assessments, facilitating automation and interoperability across tools.

Category: Standards

What are common pitfalls with Compliance as Code?

Overly rigid rules, poor mapping from legal requirements, and lack of exception workflows. These can cause developer friction and shadow IT.

Category: Mistakes

Where should Compliance as Code run in the pipeline?

Shift left in CI for fast feedback and enforce at deployment via admission policy. Periodic scans ensure continuous compliance post-deploy.

Category: Management

What is the risk of relying solely on Compliance as Code?

Automated checks may miss contextual nuances. Human oversight, audits, and continuous improvement remain essential.

Category: Risks

How do we start with Compliance as Code?

Prioritize high-impact controls, choose a policy engine, codify tests, and integrate into CI/CD. Iterate with developer and auditor feedback.

Category: Advice

Can Compliance as Code reduce audit burden?

Yes. Versioned rules and test evidence provide traceable, repeatable proofs. Auditors can sample automated results and workflows.

Category: Benefits