The change management is the deployment. The deployment pipeline records the change, the approver, the evidence, and the rollback. The change record is a by-product of the deployment. The change advisory board is unnecessary when the paved road is in place because the paved road enforces the segregation of duties and the change control.
High-Compliance Agile Delivery
The compliance is a property of the paved roads, not a separate review process. The audit trail is a by-product of the work, not a separate artefact. The operating model is what keeps the compliance current.
On this page
§ 01 ·
What high-compliance delivery is
High-compliance delivery is the discipline of shipping software at speed in a regulated context. The discipline covers four layers:
%2C%20controls%20as%20translation%20of%20framework%20into%20actions%2C%20paved%20roads%20as%20default%20templates%20and%20pipelines%20that%20make%20controls%20automatic%2C%20audit%20trail%20at%20bottom%20as%20evidence%20the%20controls%20are%20in%20place.%20Clean%20editorial%20style%2C%20muted%20palette.&src=/assets/img/diagrams/compliance-stack.svg)
- Framework. The compliance framework (SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001, the regulatory framework that applies).
- Controls. The translation of the framework into specific actions.
- Paved roads. The default templates, pipelines, and review processes that make the controls automatic.
- Audit trail. The evidence that the controls are in place.
Compliance is a property of the work
The most important property of a high-compliance delivery practice is that the compliance is a property of the delivery, not a separate review. A separate review, on a separate schedule, with a separate team, is a review that is current to last quarter and out of date with this sprint. The right answer is to design the compliance into the paved roads, so that the compliant path is the default path.
The two failure modes
The two failure modes that come up most often are:
- Compliance is a separate process. A separate process produces a slow, friction-laden delivery.
- Compliance is a checkbox. A checkbox produces an organisation that has the certificate and not the practice.
The right answer is to design the compliance into the work, so the audit trail is a by-product of the work and the controls are properties of the paved roads.
§ 02 ·
The patterns
The patterns that have held up across the organisations we work with:
Change management as code
The change management record is the deployment. The deployment pipeline records the change, the approver, the evidence, and the rollback. The change management record is a by-product of the deployment, not a separate artefact.
- The change is the diff being deployed.
- The approver is the merge approval.
- The evidence is the test pass and the security check.
- The rollback is the previous deploy, replayed.
Segregation of duties in the paved road
The segregation of duties is enforced by the deployment pipeline, not by a manual review. The pipeline requires two reviewers for the merge; the pipeline requires a security check; the pipeline requires a test pass. The segregation is a property of the pipeline.
- Two reviewers before merge.
- Security check before deploy.
- Test pass before promotion.
- Rollback verified before completion.
Audit trail as a by-product
The audit trail is generated by the work, not maintained by hand. The deployment log is the audit trail; the access log is the audit trail; the change log is the audit trail. The audit trail is a by-product.
- The deployment log records every release.
- The access log records every credential use.
- The change log records every config mutation.
- The audit trail is the union of these.
Continuous compliance
The compliance is monitored continuously, not at audit time. The pipeline blocks on compliance failures; the alerts fire on compliance violations; the dashboards surface the compliance posture in real time. The audit is the validation of the continuous practice.
- The pipeline blocks on compliance failures.
- The alerts fire on compliance violations.
- The dashboards surface the posture in real time.
- The audit is the validation of the practice.
§ 03 ·
State of the practice
1
Right answer to 'change management process' — the deployment pipeline
Industry observation
4
Common compliance frameworks (SOC 2, ISO 27001, PCI DSS, HIPAA) — usually one is enough, sometimes two
Industry observation
0
Compliance frameworks that require a separate review process when the paved road is in place
Industry observation
§ 04 ·
Questions we get asked
The one that fits the regulatory and contractual context. SOC 2 for SaaS companies selling to enterprise customers. PCI DSS for organisations that handle payment card data. HIPAA for organisations that handle protected health information. FedRAMP for organisations selling to US federal agencies. ISO 27001 for organisations that operate globally. Pick the framework that the customers and regulators require, and use it as a vocabulary for the conversation.
With the paved road, not the team size. The segregation of duties is enforced by the pipeline, not by the team structure. The pipeline requires two reviewers; the pipeline requires the security check; the pipeline requires the test pass. The segregation is a property of the paved road, not of the team.
§ 05 ·
Patterns we design our practice to avoid
A compliance review on a separate schedule is a compliance review that is out of date with the work. The compliance is a property of the paved roads. The paved road enforces the controls; the pipeline blocks on the failures. A separate review is a review that is bypassed.
An audit trail that is maintained by hand is an audit trail that is incomplete. The audit trail is generated by the work. The deployment log is the audit trail; the access log is the audit trail; the change log is the audit trail. A by-product is complete; an artefact is not.
A change advisory board that reviews every change is a change advisory board that is a bottleneck. The CAB is unnecessary when the paved road is in place because the paved road enforces the segregation of duties and the change control. The CAB is the right answer when the paved road is not in place; the paved road is the right answer when it is.
Compliance is a continuous property, not a quarterly event. The compliance is monitored continuously; the pipeline blocks on failures; the alerts fire on violations. The quarterly audit is the validation of the continuous practice, not the practice.
§ 06 ·
Evidence & references
Public frameworks and writing that inform our practice.
Accelerate
Forsgren, Humble, Kim, IT Revolution, 2018
The book that established the DORA metrics and the connection between delivery performance and organisational performance. The book is not about compliance specifically, but the evidence that high delivery performance correlates with high reliability is the foundation of the high-compliance delivery argument.
Team Topologies
Skelton and Pais, IT Revolution, 2019
The book that made platform engineering a discipline. The stream-aligned team + platform team model is the model that produces high-compliance delivery. The platform team's job is to make the compliance a property of the paved road.
Continuous Delivery
Humble and Farley, Addison-Wesley, 2010
The book that established the deployment pipeline as the change management record. The treatment of the pipeline as the audit trail, the deployment as the change record, and the rollback as the recovery is the foundation of the high-compliance delivery argument.
Building a high-compliance delivery practice?
If you are weighing a high-compliance delivery initiative, evaluating a compliance framework, or trying to make an existing practice faster without losing the audit trail, we are useful at the boundary between the framework and the paved roads. A short conversation is the right next step.
Learn more