📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
summary
Argues GRC must become an engineering function and shows a working pipeline: AWS audit playbook (Python + boto3) pulls configs to JSON, Terraform plan→JSON feeds Open Policy Agent + Gatekeeper which scores changes and auto-fails any IAM/password-policy edits, then an AI GRC coding agent (Mario Lenado, 72 files, 15 frameworks) crosswalks controls, recommends block or accept risk, and packages a ticket; demo blocks a PR, generates evidence, and rechecks post-deploy. Notes FedRAMP 20x aims for ~80% automation.
AI-written summary · about
chapters (11)
- 0:00Introduction of speaker
- 1:03Moving GRC from theory to practice
- 7:16AWS audit playbook example
- 9:47Open Policy Agent demo
- 13:41AI coding GRC plugin
- 17:34Integrating tools into workflow
- 19:38Systems design in GRC engineering
- 21:22Aligning GRC with customers
- 22:25Quick wins and adoption tips
- 24:11Key takeaways and impact
- 25:54Q&A session
related talks
32mGRC Engineering - Bringing GRC to a repository near you
40mCloud Native GRC
12mLightning Talk: Revolutionize Security GRC: Leverage AI and LLM for Continuous Control...
10mAccelerated Readiness with Global Compliance Patterns: The Winning...
30mAutomating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps
33mCompliance as Code - Lessons Learned From Regulated Organizations
55mModernizing your security and GRC strategy with AWS
32mHow Can SRE Help Security Governance?...