Compliance as code

Correct — Concrete, checkable settings for OS, cloud, and services.

Correct — You demonstrate controls meeting the selected criteria.

Correct — Type II requires continuous evidence across months.

Correct — Prescriptive controls for the card data environment.

Correct — A control library many frameworks map to.

Correct — Stop it, spot it, or fix it after.

Correct — MFA enforced once maps to SOC 2, PCI, ISO, and NIST at once.

Correct — Compliance becomes continuous and verifiable, not a manual scramble.

Correct — Clear ownership is essential for a real program.

Correct — A management-system standard with an Annex A control set.

Correct — Built on NIST 800-53 baselines.

Correct — The foundation of everything else in this course.

Correct — A wiki standard becomes an executable, gating check.

Correct — You describe what a violation looks like in the document.

Correct — Catch a non-compliant config in CI before it ships.

Correct — A failing check does not get ignored like a doc does.

Correct — e.g. require labels, block privileged pods, mandate encryption.

Correct — Prove it allows the good and blocks the bad with fixtures.

Correct — One Rego rule can gate the pipeline and the cluster.

Correct — Exceptions are deliberate, reviewed, and temporary.

Correct — You can prove how and when a control changed.

Correct — The check is the control; the gate is the enforcement.

Correct — They evaluate Terraform/CloudFormation against compliance rules.

Correct — The run itself becomes evidence the control operated.

Correct — The evidence assembles itself instead of a pre-audit scramble.

Correct — No gap between assessments for issues to hide in.

Correct — Continuous evaluation closes that blind window.

Correct — A stream of control evidence and drift signals.

Correct — The run log is auditable proof the control operated over time.

Correct — Exactly what continuous, automated evidence provides.

Correct — Traceability from control to running evidence.

Correct — Evidence integrity is an architecture decision.

Correct — The evidence exists year-round instead of being assembled last-minute.

Correct — A screenshot from audit week says nothing about the rest of the year.

Correct — Automates the evidence and gap-tracking a program needs.

Correct — Enforcement and evidence become the same artifact.

Correct — Someone changed a resource out-of-band from the IaC.

Correct — Drift from the baseline can silently break compliance.

Correct — e.g. a cron terraform plan or Config rule flags the change.

Correct — The public bucket is blocked in the PR, not in prod.

Correct — Cheaper and safer than fixing in production.

Correct — They evaluate infra code against CIS/PCI/etc.

Correct — IaC gates miss console changes; runtime evaluation catches them.

Correct — Understand intent before overwriting.

Correct — Auto-enable encryption is safe; auto-delete could break things.

Correct — Block the out-of-band change from being possible.

Correct — The earlier you catch it, the lower the cost and risk.

Correct — Gate the change in, then watch for out-of-band drift.

Correct — Prevention beats detection for the non-negotiables.

Correct — Compliance is a property of provisioning, not a later scramble.

Correct — Compliance shifts left and becomes continuous.

Correct — You pull existing evidence rather than assemble it.

Correct — The enforcement is the control; the run log is the evidence.

Correct — Auditors can verify the mapping and the running evidence.

Correct — Set guardrails once; every account inherits them.

Correct — MFA, encryption, logging map across SOC 2, PCI, ISO, NIST.

Correct — Outcomes and continuous posture, not a binder’s thickness.

Correct — Compliance-as-code makes real controls double as audit evidence.

Correct — Tick-box compliance without genuine controls is a false sense of security.

Correct — Enforcement, evidence, and audit-readiness from one automated system.