Automating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps
Talkat Open Source in Finance Forum New York 2022 · on Thursday, 2022-12-08· at 16:55· HUB 3, New York, NY, USA·
summary
Claims an automated pipeline that gets from commit to production with 100% no-human-hands, using CI-collected evidence, signed artifacts and attestations to make audits explainable. Implements a governance contract (machine-readable normalized scans from OpenSCAP, SonarQube, etc.) evaluated by policy engines like OPA/Rego at a policy enforcement gate. Shows the math: 16 hours per change, two-week release train, five changes → 59% aggregate success, motivating single-piece flow. Describes a working governance as a service: evidence repo, attestations, gate, and automated SOC2-style checks.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:14Governance delivery bottleneck
- 7:21Governance as toil
- 11:13Five principles for autonomizing governance
- 14:41What is a governance contract
- 17:04Governance contracts in CI/CD
- 19:51Governance as a service
- 21:57Building a governance team
- 26:49Conclusion and key takeaways
related talks
43mDear Security, Compliance, and Auditors, We’re Sorry. Love, DevOps.
36mKeynote - Automated Governance
22mPutting Governance Into your DevOps Processes
37mDevOps - The Automation of Compliance
01mWhat is DevGovOps?
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
32mAutomating Security Compliance at Scale
31mWrangling Compliance in the Wild West of Software Delivery