Compliance-as-Code
Compliance-as-Code is the practice of defining compliance controls, policies, and their verification as code that lives in version control, runs in CI/CD, and fails builds or raises alerts when requirements are not met -- making compliance testable and auditable like any other software behaviour.
Explanation
When a control is code, it inherits everything good about code: review, history, testing, and automation. A policy-as-code rule can block a non-compliant deploy; a test can assert encryption is enabled; a pipeline can attest that a control ran.
Compliance-as-Code is a core technique of Compliance Engineering and a prerequisite for evidence-native operation.
Why it matters
Versioned controls make change auditable and drift detectable -- you can prove exactly when and why a control changed.
Automated enforcement prevents non-compliant states from ever reaching production.
How StackWeaver applies it
StackWeaver implements policy-as-code and control tests in the client's existing pipelines, so enforcement and evidence are automatic. The <a href="/solutions/evidence-automation">Evidence Automation solution</a> delivers this; the <a href="/library/compliance-engineering">Compliance Engineering</a> practice provides the implementation context; the <a href="/evidence/control-mapping">Control Mapping</a> evidence shows policy-as-code mapped across frameworks.
What this relates to
- Compliance EngineeringTreating compliance as something built into systems through engineering -- enforced, tested, and monitored -- rather than added through documentation.
- Engineering ControlsControls implemented and enforced through engineering systems -- configuration, code, and automation -- rather than through policy and manual process.
- Evidence-Native SystemsSystems where compliance proof is a property of how they operate -- captured at the source -- not a document produced under deadline.