Auditors' Workshop: What You’ve Wanted to Ask an Auditor, but Were Afraid To Ask
summary
A live workshop answers how audits fit into DevOps with concrete practices: invest in controls early, train engineers on audit and auditors on cloud, and categorize releases so only significant changes get heavy testing. Expect policy-as-code and tools like Puppet/kubernetes to enforce configuration, a read-only evidence portal that lets auditors pull automated logs on demand, and reliance on a sample-of-one for high-frequency automated controls; encryption-in-use and coded segregation-of-duty patterns reduce manual gating, and remediation runways (often 30–60 days) still appear for some exceptions.
AI-written summary · about
chapters (18)
- 0:00Intro
- 3:30Building a building
- 3:55What are your requirements
- 5:00Standards and regulations
- 10:00The 20 bubble
- 14:20The IT security guy
- 16:55Mistranslation
- 18:48Learning failing
- 21:53Translation
- 25:41Questions
- 30:18Frequency
- 34:53Are auditors haters
- 42:01Who has access to production
- 44:00How do you think about it conceptually
- 47:11As a regulated profession we have standards
- 48:39Internal auditors believe the DevOps thing
- 51:56Policy code evolution
- 55:24Audit evidence
related talks
29mPanel Discussion: Ask an Auditor Anything: DevOps Compliance
29mAn Unlikely Happy Couple - DevOps and IT Audit?
42mSolving for DevOps Auditors with Automated Compliance
01h 02mDiscussion - Auditors, Sessions 3 & 4
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
07mAdventures in Agile Auditing: Don’t Just Survive Your Audit… Thrive in it!
22mPutting Governance Into your DevOps Processes
33mCompliance as Code - Lessons Learned From Regulated Organizations