In this article we introduce new technology that allows you to automate the change and release compliance in a Secure Software Development Lifecycle: the DevOps Compliance Journal.
Software in regulated industries
The modern world depends on financial transactions, air traffic control, insulin pumps and car braking systems. When technology becomes critical to our lives and our economies there is increased demand from customers and regulatory bodies to control these risks.
In order to meet these requirements, organizations must define software development processes that ensure that safety and security risks are managed in a professional and repeatable manner.
Having defined and implemented a process, it is critical to document the proof that the process is being followed. It is this evidence that auditors inspect to ensure that the organization is compliant with the regulations.
Software is eating the world
Regulated software development processes require many activities like version control practices, code review, security scanning, testing, and more. Typically, these activities are spread over several software systems.
This makes it hard to know if the compliance process is being followed and to know what to do if/when compliance steps are skipped. Eventually, this creates a headache when it’s time for release and audit.
As software takes an increasingly central role in the success of all types of businesses, the demand to deliver more frequently increases the pressure on innovation cycle times.
For regulated industries, the challenge they face is overcoming the manual and bureaucratic processes that worked well in the past.
Through a combination of culture, automation, lean, measurement, and sharing changes, DevOps provides a proven technique to enable today’s best performing technology organizations. However, meeting compliance requirements with DevOps demands new approaches.
Most regulations are written for general guidance and don’t specify an exact recipe to follow. In order to comply, organizations have traditionally implemented manual documentation and gate-checks, with every software release documenting the proof that the agreed processes have been followed.
The DevOps Compliance Journal provides a means of automating all the documentation and checkpoints necessary to comply with regulations.
The DevOps Compliance Journal
So, what is a DevOps Compliance Journal?
A DevOps Compliance Journal is a special type of database for recording your software process automatically. It provides an API for recording various compliance events such as build, code review, security scan, or release, directly from your DevOps pipelines. Implementing this central system of record provides insight across the organization, giving development, operations, security and risk a shared view of compliance.
An important consideration when choosing how to store this data is how it will be used. When the goal is to prove compliance with a software process, it is essential that the data is stored using a provable, secure, tamper-proof method.
Storing information in a way that allows for untraceable modification is pointless. This is why a DevOps Compliance Journal is based on an append-only datastore. It allows new versions of data to be added without losing the history. It is only with this non-modification guarantee that compliance can be proven.
Properties of a DevOps Compliance Journal
Having a DevOps Compliance Journal means you can begin the journey to Continuous Compliance by automating change and release controls.
The first step in automating your software process compliance is to start recording the audit trail in your DevOps pipeline. The DevOps pipeline is the best place to do this because it is the heartbeat of software change.
By recording the relevant change control data in your DevOps pipeline you can query it for change control. How this is implemented depends on your process, but it could be a pre-merge control, or an artifact promotion control. However you approach this, the end result is the same: all changes in your software are automatically compliant with your process.
Now you have your software change process under control the next step is to manage the release process.
Most software releases are made up of a collection of individual changes. The challenge this imposes on regulated software teams is proving that all of the changes included in a release have followed process.
A DevOps Compliance Journal can provide aggregate and composite views of change. This enables all stakeholders to share a common view of compliance across development, test, security, internal and external audit, automatically.
Continuous Compliance with ComplianceDB
Delivering at pace within a safe, secure, and repeatable process puts demands on regulated industries. Implementing a DevOps Compliance Journal is an essential step on the path to unlocking DevOps performance.
The good news is that you don’t have to build your own DevOps Compliance Journal. ComplianceDB implements a cryptographically secure, version-aware DevOps Compliance Journal that fits into your existing ways of working.
Learn more about how ComplianceDB can help you deliver compliant software at speed.