Bringing DevOps Principles to Controls and Audit

In 2025, many organizations still manage critical compliance controls through manual checks, spreadsheets, Word documents, and Confluence pages—approaches that are error-prone, inefficient, and increasingly outdated. In 2023, frustrated by these challenges, a group of Cloud Native engineers decided to address this gap head-on by creating an open-source solution designed from the ground up to automate Governance, Risk, and Compliance (GRC).

This initiative aligned with broader movements across the industry, including NIST's Open Security Controls Assessment Language (OSCAL) and the European Union's Digital Operational Resilience Act (DORA), underscoring a global shift toward standardized, automated compliance frameworks.

This session shares our journey into Continuous Compliance: the motivations behind the project, key lessons learned from our mistakes, and insights from ongoing development and community advocacy. Attendees will gain practical guidance on leveraging Continuous Compliance principles to reduce risk, streamline governance processes, and move their organizations beyond manual compliance into automated, real-time assurance.