Continuous Compliance Vocabulary

Compliance-as-code treats compliance controls as code — using tools like Open Policy Agent, Chef InSpec, or AWS Config rules to automatically enforce controls and generate machine-readable evidence. This replaces manual quarterly checks with continuous automated validation.

When compliance controls are integrated into the CI/CD pipeline, every deployment tests and documents control status. This creates a continuous stream of evidence and catches drift immediately — a major improvement over point-in-time annual audits.

Configuration drift occurs when actual infrastructure state diverges from the declared desired state. In compliance contexts, drift means resources no longer meet policy requirements — often caused by manual changes bypassing the approved change management process.

Policy adherence percentage measures what fraction of compliance checks are currently passing. 94% means 6% of resources or controls have drifted from required policy — those items need investigation and remediation. Continuous compliance dashboards show this in real time.

Manual evidence collection (screenshots, exports, spreadsheets) is labor-intensive, error-prone, and only captures a moment in time. Automated evidence collection continuously captures structured data — who approved what, when controls ran, what the state was — making audits faster and more reliable.