Regulated compliance has become a business liabil-ity given the constant changes to the IT environments driven by the new Cloud normal enabling daily upgrades, and by the new programs related to cybersecurity. To keep pace with the changes, enterprises and auditor agencies shifted from annual audit to continuous compliance. Critical enablers of continuous compliance are standardization and automation. To achieve this, we need to treat everything as code, from the compliance artifacts to the policies and their results. Currently, Compliance as Code (CaC) is utilized to represent compliance artifacts and processes, while Policy as Code (PaC) is employed to express the logic of validating the actual state of the systems against the desired state. Although there is emerging technology for codifying compliance and policy, there are challenges that hinder the compliance digitization transformation towards continuous compliance. The first challenge is how to migrate from document-based operations to the program-based operations. The second challenge arises from the disconnect between CaC and the varied native interfaces of existing PaC solutions. Lastly, there is a concern regarding the reliability of results from end-to-end automation when replacing human-in-the-loop overseeing and guaranteeing the integrity with fully automated process. To address these challenges, we have developed a GitOps-based secure pipeline framework, seamlessly integrating compliance authoring with CaC while ensuring the secure integration of Compliance as Code and Policy as Code, protecting data integrity and preserving data traceability. In this paper, we present the details of the framework which enables end-to-end automation of compliance processes while supporting integration with various Policy Validation Points (PVPs), and showcase the evaluation of our implemented solution's reliability by testing risks such as unintentional modification of policies.

Automation of cybersecurity processes has become crucial with large scale deployment of sensitive workloads in regulated on-prem, private, and public cloud environments. Regulatory and standards bodies such as Payment Card Industry (PCI), Federal Financial Institutions Examination Council (FFIEC), International Organization for Standardization (ISO), and others govern the minimal set of cybersecurity controls that an organization must implement. To meet such requirements while maintaining business agility, organizations need to modernize from manual document based compliance management to automated processes for continuous compliance. This modernized process is called compliance-as-code. In this paper, we present an architecture for compliance-as-code based on a standardized framework. We identify several design choices and our rationale behind those. Specifically, we introduce a system for manipulating compliance information in a standardized manner and a data interchange protocol for inter-operable communication of compliance information. We demonstrate the scalability of our approach and briefly describe deployment and experimental results in real world settings.

In order to make software components more flexible and reusable, it is desirable to provide business users with facilities to assemble and control them without their needing programming knowledge. This paper describes a fully functional prototype middleware system where variability is externalized so that core applications need not be altered for anticipated changes. In this system, application behavior modification is fast and easy, making this middleware suitable for frequently changing programs.