OSCAL in Action: Real World Examples of Automating Policy & Comp...
summary
Practical pipeline that turns OSCAL assessment plans into enforceable policy as code: OSCAL Compass C2P v2 translates requirements into Open Policy Agent Rego bundles, packages them as OCI policy bundles, and pushes them to registries; enforcement queries GitHub branch protection via the OPA plugin, emits decision logs and traces through the OpenTelemetry collector to Loki and S3, and rehydrates those logs into OSCAL assessment results that provide auditable, traceable evidence.
AI-written summary · about
chapters (13)
- 0:00Modernizing compliance
- 2:05Limitations of legacy GRC
- 3:26Introduction to OSCAL
- 3:50Traceability in compliance
- 4:41The compliance toolkit
- 8:11Governance and rule creation
- 9:56Policy as code
- 10:57Generating policy bundles
- 12:15Enforcement and telemetry
- 13:05Curating evidence
- 15:32Continuous monitoring
- 16:31Final audit and wrap-up
- 19:13Q&A session
related talks
43m12 Essential Requirements for Policy Enforcement and Governance with OSCAL
37mPath To Production: Sustainable Compliance In Strict Environments
40mAutomating Security and Compliance via a new standard-of-standards
33mOpen Policy Agent Deep Dive
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
41mAvoiding IAC Potholes with Policy + Cloud Controllers
25mOpen Policy Agent as a Control Engine
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...