Continuous compliance is the practice of ensuring that software development processes and technologies meet regulatory and security standards on an ongoing basis through automation. Manual compliance checks can slow development and introduce human error, whereas automated checks and audits provide faster feedback, clearer evidence and simplified reporting.
By integrating policy-as-code tools such as Open Policy Agent and generating SBOMs within CD pipelines — aligned with SLSA guidance — teams can detect and address compliance issues early. Codifying rules and best practices enforces standards consistently across teams without creating bottlenecks. OSCAL also shows promise as a framework for automating compliance at scale.
Practices and tooling for continuous compliance are now mature enough that it should be treated as a sensible default, which is why we’ve moved our recommendation to Adopt. The increasing use of AI in coding — and the accompanying risk of complacency with AI-generated code — makes embedding compliance into the development process more critical than ever.
持续合规 是一种实践，旨在确保软件开发过程以及相关技术一直遵守行业法规和安全标准，这一过程大量依赖自动化，人工操作可能会降低开发速度并引入错误。作为替代，组织可以自动化合规检查和审计。他们可以将工具集成到软件开发流水线中，使团队能够在开发过程的早期发现并处理合规问题。将合规规则和最佳实践编码化有助于在团队间执行一致的政策和标准。它使用户能够扫描代码变更中的漏洞、强制执行编码标准以及追踪基础设施配置变更，以确保它们满足合规要求。最后，以上内容的自动化报告简化了审计工作，并提供了清晰的合规证据。我们已经讨论过诸如发布软件物料清单（SBOMs）和应用软件供应链层级建议的技术 — 很适合在早期进行这样的尝试。这种技术的好处是多方面的。首先，自动化能够带来更安全的软件，可以在早期识别并处理漏洞，其次，随着手动任务的消除，开发速度也会加快。最后，还能够降低成本和提高一致性。对于像软件驱动汽车这样的安全关键行业，自动化持续合规可以提高认证过程的效率和可靠性，最终造就更安全、更可靠的车辆。
