Conducting comprehensive audits on CI/CD design patterns
Audits are a more formal process to address any potential gaps in the overall CI/CD posture. They involve policies and data security, encompass compliance and regulatory requirements, and follow a defined documentation process.
Audits are often done for third-party assurance. Regular internal audits and health checks are done to facilitate third-party audits, keeping a close eye on activities and bringing the right level of management control, examining changes, and demonstrating that regulatory and compliance standards are followed.
Many advocates talk about shifting the audit process due to the complexity of the activity. Auditors might require information and data points regarding deployment success rates, for example. We also highlighted the need for embedding policy as code specifically for regular sectors in Chapter 8.
The auditability of CI/CD design patterns is directly associated with the traceability of the...
