We believe Gartner provides very useful guidance for organizations struggling with balancing the need to deliver products and services to market faster while having to deal with regulations and compliance requirements that may overburden their teams. The report is titled "3 Steps to Ensure Compliance and Audit Success with DevOps," which Chef has made available as a complimentary download for you here: https://chef.io/gartner2020
[We also just hosted a SecureWorld panel discussion on DevSecOps on Thursday, July 23rd. Be sure to check out the on-demand recording!]
Among their recommendations, Gartner suggests organizations "balance speed and risk by implementing compliance-as-code (CaC) tools to continuously detect and remediate compliance violations." Chef InSpec is recognized among the commercial products and open-source software compliance automation tools in the report, and according to Gartner "these tools enable continuous compliance to provide organizations with built-in solutions for common industry-specific regulations like SOX, PCI-DSS, HIPAA, DISA-STIG and GDPR."
As the title suggests, the report outlines three key strategies Infrastructure and Operations (I&O) leaders should consider to be successful with compliance and audits in this modern day of DevSecOps practices.
- 'Collaborate to Optimize and Simplify the Required Controls'
Where all stakeholders hold responsibility for security and compliance within the organization. The report mentions "I&O leaders should work with relevant leadership—including chief risk officers and chief audit officers—to document and approve the organization’s risk appetite and mitigation strategy."
- 'Balance Speed and Risk by Leveraging Automation and Implementing Compliance as Code'
Where teams should implement compliance automation, especially where the report puts it "DevOps teams need to implement CaC [Compliance as Code] by extending automation and infrastructure as code (IaC) to run tests against environments and ensure compliance."
- 'Continuously Assess Toolchains Against the Organization's Security and Compliance Requirements'
Where toolchains become the primary way of delivering a continuous process to make sure continuous compliance is reached. The report highlights that "CaC [Compliance as Code], IaC [Infrastructure as Code] and continuous configuration automation (CCA) are all valuable for security and compliance."
Compliance as Code with Chef Effortless Infrastructure
A key piece to compliance automation success is the ability to validate early and often in the software development lifecycle. Instead of performing compliance scans during security review right before deploying to production, Chef InSpec, a part of Chef’s Effortless Infrastructure Suite, enables organizations to test continuously as they move from one stage to the next in their software delivery process.
Chef Effortless Infrastructure Suite offers visibility into security and compliance status across all infrastructure and makes it easy to detect and correct issues long before they reach production.
Chef Effortless Infrastructure Suite translates infrastructure configuration and compliance policies into code, helping enterprises detect (with Chef InSpec) and correct (with Chef Infra) potential security issues at scale.
Not only can Chef InSpec be used to test and detect compliance issues with Chef Infra as part of the Chef Effortless Infrastructure Suite, but it also works with other configuration automation tools, such as Ansible, to ensure your environments remain continuous compliant.
Chef Effortless Infrastructure Suite provides closed-loop detect-and-correct capabilities of compliance as code and unparalleled content for security validation, including compliance profiles for CIS Benchmarks and DISA STIGs.
What's next?
Join the SecureWorld
And download the Gartner report, "3 Steps to Ensure Compliance and Audit Success with DevOps," which Chef has made available complimentary here: https://chef.io/gartner2020.
To learn more about Chef's compliance capabilities, visit: https://chef.io/compliance.
And for more information on Chef Effortless Infrastructure Suite, visit: https://www.chef.io/products/effortless-infrastructure.
