DevOps accelerator for control compliance, PaCE execution, and exception management

  • Release version: Xanadu
  • Updated August 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of DevOps Accelerator for Control Compliance, PaCE Execution, and Exception Management

    The GRC: DevOps Accelerator is an application designed to help customers assess compliance with DevOps policies and GRC control objectives, integrating seamlessly with the Policy as a Code Engine (PaCE). Starting from the Washington DC release, this feature is being prepared for deprecation but will still be supported for existing users.

    Show full answer Show less

    Key Features

    • Integration with various regulations, standards, and frameworks such as CIS, NIST 800-53, ISO 27002, and PCI DSS.
    • Mapping of control objectives against DevOps policies provided through the DevOps Config Policy Content Pack.
    • Monitoring of control compliance and visualization of PaCE execution evidence for DevOps managers.
    • Management of exceptions within the compliance framework.

    Prerequisites

    • Hierarchy of PaCE-related and CDM-related plugins.
    • DevOps Config Policy Content Pack.
    • GRC plugins such as Cybersecurity Controls Accelerator, Compliance UCF, and Continuous Authorization and Monitoring.

    Key Outcomes

    By utilizing the GRC: DevOps Accelerator, customers can efficiently evaluate compliance status, manage control objectives, and facilitate the mapping between PaCE policies and GRC control objectives. This process is automated through a scheduled job that updates the staging table and moves records to the main control objective mapping table, allowing for streamlined compliance management.

    GRC: DevOps Accelerator is an application that enables your customers to evaluate the compliance for DevOps policies and GRC control objectives integrating with Policy as a Code Engine (PaCE).

    Important:
    Starting with the Washington DC release, GRC DevOps Use Case Accelerator is being prepared for future deprecation. It will be hidden and no longer activated on new instances but will continue to be supported.

    GRC: DevOps Accelerator (com.sn_grc_devops) plugin maps the control objectives drawn from regulations, standards, and frameworks, such as CIS controls, NIST 800-53, ISO 27002, PCI DSS, and others with DevOps Policy as a Code Engine (PaCE). The DevOps policies are provided by the DevOps Config Policy Content Pack.

    With this integration you can evaluate the compliance status. The integration also enables the DevOps managers to monitor control compliance, visualize evidence of PaCE execution, and manage exceptions.

    Pre-requisites for DevOps accelerator

    1. Hierarchy of PaCE-related plugins and CDM-related plugins.
    2. DevOps Config Policy Content Pack provided by PaCE.
    3. GRC plugins: GRC: Cybersecurity Controls Accelerator, GRC: Compliance UCF, and GRC: Continuous Authorization and Monitoring.
    Note:
    GRC: DevOps Accelerator (com.sn_grc_devops) is dependent on DevOps Config Policy Content Pack and GRC: Policy and Compliance Management. However, if GRC: Cybersecurity Controls Accelerator (CIS), GRC: Unified Compliance Framework (UCF), and GRC: Continuous Authorization and Monitoring (CAM) plugins are not installed on the instance, then the staging data relevant to the control objectives from these plugins would not be available on installing GRC: DevOps Accelerator.
    GRC: DevOps Accelerator plugin maps the relationship between PaCE policies and control objectives.
    Note:
    Not all GRC control objectives may have a relationship with every PaCE policy.

    Populating control objective and PaCE mapping data from the instances to staging table

    Control objective to items mapping table
    As part of DevOps accelerator, the mapping relationships between control objectives and PaCE policies are shipped to the customers. The relationship is captured in Control objective to items [sn_compliance_control_objective_item] table, where the Control objective column and Item record column, which is the PaCE policy, list the data.
    Figure 1. Control objective to item table
    Control objective to item table.
    DevOps policy to control objective staging table
    Figure 2. DevOps accelerator staging table
    DevOps accelerator staging table.

    There is a staging table as a part of DevOps accelerator, which is DevOps policy to control objective staging [sn_grc_devops_policy_control_objective_staging] table. A user with Compliance admin role can view the table.

    For CAM and CIS, the sys IDs of the control objectives map with the DevOps policy sys IDs. However, for UCF the source ID of the control objective imported from the Shared List is mapped with the DevOps policy sys ID.

    The data in the DevOps policy to control objective staging [sn_grc_devops_policy_control_objective_staging] table is shipped in Pending status. The data is populated in the staging table based on the applications that are installed in the instance. The data is not processed if the control objective and the PaCE policy do not exist in the instance.

    Scheduled job to move data from the staging to the main table

    A daily job (Import DevOps policy to Control Objective mapping from staging) runs after the applications and the DevOps accelerator are installed to add the records to the Control objective to items (sn_compliance_control_objective_item) table. If the record is successfully added to the mapping table, then the status of the record in the staging table moves to Processed. If a control objective is not populated or present in the application, then the record is not processed but is in Pending status.