Compliance As Code Governance

Compliance-as-Code Governance

Overview

This skill codifies compliance controls as executable policy integrated into CI/CD and runtime admission. It bridges SOC 2 CC8 (change management), CC5 (control activities), HIPAA §164.312 (technical safeguards), and PCI Req 2 (secure configurations) through:

• OPA/Rego policies for Kubernetes, API gateways, and custom resources
• Terraform/IaC scanning (Checkov, tfsec, terraform-compliance)
• Git-pre-merge gates blocking non-compliant infrastructure
• Policy versioning aligned with TSC control matrix

Compliance-as-code is not a substitute for auditor evidence—it generates continuous proof consumed by soc2-ccm-continuous-monitoring and soc2-evidence-collection.

When to Use

Use this skill when:

• Codifying security baselines (encryption, public access, MFA) as OPA/Rego or scan rules
• Adding CI gates for Terraform, Kubernetes manifests, or MCP server configs
• Remediating drift detected by CCM with policy updates
• Standardizing agent deployment guardrails (skills validation, redaction required)
• Mapping policy rules to TSC/PCI/HIPAA control IDs for traceability
• Building exception workflows for time-bound policy waivers with approval

Do not use this skill when:

• Legal BAA negotiation (use hipaa-baa-vendor-assessment)
• Initial TSC gap analysis without automation intent (use soc2-trust-services-criteria)
• Payment page script inventory (use pci-dss-script-audit)

Core Process

Execute steps in order.

Step 1: Policy scope and control mapping

1. Import control requirements from TSC matrix, PCI Req 1-2, HIPAA §164.312.
2. Select automatable controls (encryption flags, SG rules, IAM policies, public exposure).
3. Create traceability matrix:

Artifact: policy-control-matrix-{id}.csv.

Step 2: OPA/Rego policy development

1. Organize policies in policy/ directory with package naming convention:

   package compliance.soc2.cc6
   

2. Write Rego rules with deny messages citing control ID:

   deny[msg] {
     input.resource.type == "aws_s3_bucket"
     input.resource.public_access == true
     msg := "CC6.1/PCI1.3: S3 bucket must not allow public access"
   }
   

3. Include unit tests (*_test.rego) with positive and negative cases.
4. Version policies in git; tag releases aligned with baseline promotions.

Step 3: Terraform/IaC scanning

1. Configure Checkov or tfsec with custom checks mapped to policy IDs.
2. Scan targets: VPC, SG, IAM, RDS, EKS, MCP deployment modules.
3. Fail CI on CRITICAL/HIGH unless documented exception ID present in resource tag: ComplianceException = EX-2025-042
4. Export SARIF/JSON for evidence store.

Step 4: CI/CD pipeline integration

1. Pipeline stages:
   • Lint: Rego compilation, policy tests
   • Plan scan: Terraform plan JSON → OPA evaluation
   • Apply gate: manual approval for production with policy summary
2. Agent-specific gates:
   • SkillsCapability(validate=True) must remain enabled in agent.py
   • redactor.redact() must precede compliance_agent.run() (static analysis or AST check)
   • New skills/*/SKILL.md must pass schema validation
3. Block merge on policy failure—no --no-verify bypass without security approval.

Step 5: Runtime admission (optional)

1. Deploy OPA as admission controller (Kubernetes) or API gateway plugin.
2. Enforce policies on MCP server deployments: resource limits, network policies, secret mounts.
3. Log deny decisions to SIEM for CC7 evidence.

Step 6: Exception management

1. Exception request requires: control ID, risk analysis, approver, expiry date (max 90 days default).
2. Tag affected resources; CCM monitors exception expiry.
3. Expired exceptions → auto-FAIL in CCM dashboard.

Step 7: Drift remediation loop

1. When CCM detects drift, determine if:
   • Policy gap (update Rego)
   • Unauthorized change (incident)
   • Authorized change (update baseline)
2. Link remediation PR to control ID and evidence hash post-merge.

Step 8: Evidence and reporting

1. Store CI scan outputs with SHA-256 in evidence bucket.
2. Monthly report: policy pass rate, top violations, mean time to remediate.
3. Feed soc2-evidence-collection for CC8 change and CC5 control activity samples.

Common Rationalizations

Red Flags

• Terraform apply without plan-time policy scan
• Public cloud resources deployed with ComplianceException tag and no ticket
• OPA policies without unit tests or version control
• Agent deployment bypasses redaction gate in CI
• Policy matrix missing mapping to control IDs (orphan rules)
• Exception expiry dates passed with no remediation
• Scan results stored only in ephemeral CI logs (no evidence retention)

Verification

• Policy-control traceability matrix complete with severity levels
• OPA/Rego policies written with unit tests and git versioning
• Terraform/IaC scanning integrated in CI with CRITICAL/HIGH block rules
• Agent-specific gates verify skills validation and redaction call order
• Exception workflow documented with max expiry and approver roles
• Runtime admission deployed (if in scope) with deny logging to SIEM
• CCM integration feeds drift events into remediation loop
• Monthly policy compliance report generated with pass rates
• Scan artifacts retained with SHA-256 for SOC 2 evidence
• No CRITICAL violations in production without active approved exception