Compliance evidence as code

Most compliance effort goes into proving that controls work, not into the controls themselves. When controls are defined as code and checked automatically, the evidence is a by-product of normal operation: current, complete and consistent across every environment.

The business problem

Before each audit, engineers spend weeks collecting screenshots, exports and spreadsheets to show encryption, access reviews, logging and change control. The evidence is out of date as soon as it is collected, and gaps found during the audit trigger urgent remediation.

Constraints

• Several frameworks at once, for example ISO 27001, SOC 2, DORA or the EU AI Act.
• Cloud, Kubernetes, SaaS and on-premises systems in scope.
• Auditors who need traceable, tamper-evident evidence.
• Engineering teams that cannot absorb a large manual overhead.

Architecture

Control lifecycleAutomated end to end

1. DefineControl written as policy code, linked to framework requirements
2. PreventChecked in pipelines before deployment
3. DetectChecked continuously against live cloud and cluster state
4. CollectResults stored as time-stamped, tamper-evident evidence
5. MapOne control mapped to many frameworks
6. ReportDashboards for owners, exports for auditors

Test once, satisfy many frameworks

1. PreventivePipeline and admission policies block non-compliant changesStops issues at source
2. DetectiveContinuous checks on live configuration and accessFinds drift quickly
3. CorrectiveAutomated remediation for known, safe fixesCloses gaps in minutes
4. EvidenceEvery check result retained and mapped to requirementsAudit-ready at any time

From stopping issues to proving control

Key decisions and trade-offs

• Common control set: one internal control library mapped to each framework, rather than separate programmes per framework.
• Prevention first: block known-bad configurations in pipelines and at admission; detect only what cannot be prevented.
• Evidence is data: results are stored with time stamps, scope and owner, and kept tamper-evident for the retention period.
• Owners per control: each control has a named owner and a clear route for exceptions, with expiry dates.
• Include AI systems: model inventories, evaluation results and AI gateway logs become evidence for AI governance.