►
Description
Speaker: Saumya Upadhyaya
Compliance requires organizations to adopt processes that help them adhere to regulatory and legal requirements. Often, these processes are costly, manual, and cumbersome to implement and maintain. Even organizations that are advanced in compliance maturity still maintain processes within spreadsheets, file storage systems (such as Google Drives or Dropbox) ,and emails—making wading through the documentation required to prove compliance extremely painful.
The good news is that it does not have to be so overwhelming. GitLab can make compliance management friendly, straightforward, and as frictionless as possible.
Learn how GitLab can help make your compliance initiatives seamless:
* Why is achieving compliance so difficult?
* Prerequisites for building your compliance program
* Achieving compliance success with GitLab
Get in touch with Sales: http://bit.ly/2IygR7z
A
Compliance
requires
organizations
to
adopt
processes
that
help
them
to
adhere
to
regulatory
and
legal
requirements,
but,
frankly
that
can
be
a
pain
in
essentials
of
building
a
compliance
program
with
git
lab
somia.
Apadaya
will
talk
to
us
about
how
gitlab
can
make
compliance
management
friendly,
straightforward
and
as
frictionless
as
possible.
B
Good
evening,
wherever
you
are
in
the
world,
my
name
is
saumya
apathya
and
I'm
a
product
marketing
manager
here
at
gitlab.
Welcome
to
the
gitlab
virtual
comment.
2020
and
today
I'm
going
to
walk
you
through
the
essentials
of
building
a
compliance
program
with
gitlab
software
is
eating
the
world
more.
So
now,
with
a
large
population
of
the
world,
working
digitally
and
remotely
the
demand
for
digital
and
application
content
has
increased
significantly.
B
As
per
a
recent
cyber
security
business
report,
developers
are
creating
two
billion
lines
of
code
on
a
weekly
basis.
This
means
that
developers
are
building
code
faster
than
ever
to
generate
a
lot
of
customer
value.
Let's
take
an
example
in
telehealth,
which
seems
to
be
the
hottest
sector
at
the
moment.
So
accuracy
in
the
united
kingdom
was
able
to
build
a
video
chat
application
to
be
used
by
general
practitioners
for
consultation
in
in
the
span
of
a
weekend
now
they're
servicing
over
35
000
consultations
a
day.
This
has
be
this.
B
This
was
in
the
back
burner
for
at
least
four
years
mired
in
concerns
of
risk
and
privacy
for
the
company.
In
this
case
now,
it
became
essential
for
their
survival.
Business
survival
here
depends
on
being
able
to
pivot
fast
and
build
fast.
So
today
we
are
here
to
understand
if
compliance
can
really
keep
up
with
this
rapid
pace
of
development.
B
The
next
big
challenge
is
the
cost
of
non-compliance,
which
is
at
least
2.7
times
the
cost
of
the
cost
of
compliance.
These
non-compliance
costs
span
across
business
disruption,
revenue
losses,
legal
fees,
penalties
and
fines.
For
example,
one
of
the
largest
gdpr
fines
was
applied
to
british
airways
in
2019.,
so
card
skimming
over
a
period
of
two
weeks
allowed
500
000
customer
records
to
be
stolen.
B
The
last
challenge
is
the
amount
of
time
spent
on
compliance
related
activities,
a
hyper-proof
it
compliance
report
found
employees
that
are
not
part
of
the
compliance
team
spend
on
an
average
eight
hours.
Every
two
weeks,
catering
to
compliance
related
needs,
leading
to
a
huge
loss
in
productivity
and
employee
dissatisfaction,
and
the
reality
of
the
situation
is
that
even
achieving
even
basic
compliance
is
hard.
The
same
hyperproof
report
actually
showed
that
over
50
percent
of
organization
still
use
a
combination
of
spreadsheets
file
systems
and
emails
to
manage
their
programs.
B
Imagine
the
overhead
of
managing
this
also
imagine
the
state
of
their
compliance
program.
If
this
process
expert
in
compliance
decides
to
leave
the
organization
scaling,
compliance
really
means
empowering
developers
and
automating
their
tasks,
so
that
compliance
is
part
of
the
process
itself
and
not
a
separate
activity.
B
But
that
is
a
challenge
right,
so
most
organizations
have
adopted
devops
on
a
need
basis,
so
if
they
have
based
on
specific
problems
that
they
would
like
to
solve,
so
if
they
have
a
source
code
problem,
they
bring
in
a
tool
to
fix
that
specific
problem.
If
they
have
a
code
review
problem,
they
bring
in
another
tool
over
time
the
landscape
has
evolved
into
a
you
know,
a
frankenstein
system
which
requires
many
people
to
create,
manage
and
maintain
the
integrations
themselves.
B
B
Now,
when
you
lay
your
security
and
compliance
on
top
of
it,
it
only
compounds
the
problem.
Further.
Let's
talk
about
security
compliance,
individual
vendors
for
security
offers
specific
point
products
for
each
type
of
security
testing,
be
it
static,
dynamic
dependency,
mapping,
cloud
container,
etc.
Each
has
its
own
license,
cost
and
integration
requirements
established
vendors.
I
had
very
happy
to
sell
you
yet
another
product
to
give
you
a
dashboard
that
pulls
the
results
off
from
all
of
these
various
different
tools
that
they
have.
B
This
makes
achieving
visibility
from
a
security
point
of
view
more
challenging
and
when
it
comes
to
compliance
using
different
tools
means
your
compliance
policies.
Enforcement
traceability
needs
to
be
set
up
across
these
various
tools.
As
well,
this
calls
for
more
fragile
integrations,
which
need
to
be
managed
as
well.
B
B
Any
well-defined
compliance
program
requires,
inter
internal
controls
that
allow
five
key
things
right,
so
one
defining
rules
and
policies
aligned
with
your
organizational
organizational
or
regulatory
or
the
legal
requirements,
the
second
being
generating
and
maintaining
evidence
of
policy
adherence
third
being
once
you've
generated
and
maintained
the
evidence
you
need
to
be
able
to,
or
once
you've
defined,
the
rules
and
policy.
You
need
to
be
able
to
enforce
the
defined
rules
and
policies.
B
Fourth,
is
you
need
to
be
able
to
demonstrate
your
compliance
with
easy
to
access
and
readable
reports
and
evidence?
Artifacts
and
fifth:
is
it
is
not
a
one-time
setup
and
you're
done
right?
You
need
to
to
conduct
ongoing
risk
assessments
to
detect
and
mitigate
any
gaps
in
compliance,
so
any
compliance
program
that
does
not
bring
together.
B
All
of
these
controls
incurs
the
administrative
overhead
of
maintenance
organizations
often
run
the
risk
of
overspending
on
various
different
tools,
creating
data
silos
resulting
in
them
being
no
better
than
when
they
started
their
compliance
process,
so
gitlab
being
a
single
application
where
developers,
security
and
operational
personnel
congregate.
We
are
well
positioned
to
automate
your
compliance
processes
to
answer
the
questions
that
may
arise
from
your
auditors
and
leadership
team.
B
So,
let's
talk
about
how
we
do
it
right.
So
the
first
step
towards
compliance
like
we
spoke
about
is
the
ability
to
define
the
policies
that
that
adhere
to
organizational
regulatory
or
legal
requirements.
So
in
the
devops
ecosystem,
this
could
mean
who
can
approve
an
mr.
What
is
our
password
management
policy?
What
is
our
security
policy?
What's
our
scanning
policy,
and
so
on,
with
granular
user
roles
and
permissions
in
gitlab,
you
are
unable
to
enforce
segregation
of
duties.
B
You
can
easily
define
your
organization's
policies
regarding
credentials,
security
scanning
and
rules
for
approvers
as
well.
Granular
permission
control
allows
you
to
enforce
approval
approvers
to
determine
what
actually
finally
goes
into
production
and
application.
Security
is.
A
big
part
is,
is
an
integral
part
of
our
ci
cd
pipeline
itself.
With
that,
you
can
then
automate
your
information
security
compliance
requirements
so
organize
the
organizations
these
days
have
to
comply
with
various
compliance
frameworks
and
they're
increasing
by
the
day
on
an
average,
an
organization
needs
to
comply
with
at
least
three
frameworks.
B
So
with
gitlab
you
can
define
custom
projects
like
hipaa
or
sox
to
extract
adherence
to
various
different
compliance
frameworks
in
a
single
place.
We
also
have
started
to
provide
the
some
of
these
compliance
frameworks
out
of
the
box
within
the
gitlab
projects
itself.
Issues
and
merge
requests
are
central
places
where
team
members
can
collaborate.
They
can
also
maintain
documents
as
well
as
track
chain
of
custody
and
override
without
maintaining
these
on
various
different
tools,
thereby
helping
you
to
maintain
traceability
and
a
history
of
collaboration.
B
Compliance
checks
should
be
part
of
the
merge
request
so
that
the
non-compliant
code
is
not
merged
into
the
main
branch.
So
with
gitlab,
you
can
actually
do
that.
You
can
apply
specific
compliance.
Checks
like
who
can
approve,
who
can
modify
settings
to
projects
marked
with
a
compliance
label,
and
then
you
can
track
the
status
of
the
compliance
within
the
mr
itself,
whether
you've
been
compliant
or
not
to
those
rules.
B
So
we've
received
a
few
questions.
Whether
customers
can
create
their
own
custom.
Compliance
templates
to
host
relevant
rules
regulations
that
they
would
like
to
follow
so
similar
to
the
enterprise
templates
that
we've
defined
for
hipaa.
As
an
example,
a
custom
project
template
can
be
created
to
host
all
the
relevant
rules
and
regulations
necessary
for
for
that
framework
that
that
you
have
as
git
lab
issues.
B
In
addition,
documentation
and
file
uploads
related
to
this
can
be
hosted
within
the
issue
itself
in
a
tool
that
the
developers
are
familiar
with,
rather
than
integrating
a
complex
external
tool.
So
in
the
future,
we
will
also
enable
compliance
controls,
common
compliance
controls
like
user
permissions
approvers,
which
can
be
applied
to
projects
with
specific
regulated
framework
labels
itself.
So,
while
by
collating
within
everything
within
the
compliance
project,
you
can
automate
audit
records,
such
as
tracking
the
chain
of
custody,
lists
of
comments,
mergers
approvers
for
projects
labeled
for
that
particular
framework.
B
So,
as
mentioned
earlier,
gitlab
is
developing
enterprise
templates
that
enable
you
to
streamline
audit
management
with
certain
regulatory
standards.
These
templates
will
automatically
import
issues
that
correspond
to
each
regulatory
requirement.
As
a
first
step,
we
have
started
with
the
hipaa
audit
protocol,
which
is
already
available
next
in
plan
is
socks
and
software.
So,
in
addition,
we've
also
put
together
some
guidance
in
in
terms
of
how
gitlab
security
and
compliance
features
can
be
used
to
demonstrate
attendance
to
specific
frameworks
like
the
ones
that
we've
listed
in
this
slide.
B
You
can
actually
go
to
these
links,
and
these
links
include
guidance
for
how
you
can
use
features
like
static
application,
security,
testing,
dynamic
testing,
container
scanning
and
so
on,
as
well
as
compliance
features
like
segregation
of
controls,
audit,
logs
and
events.
Credential
inventories
and
so
on
to
how
you
can
use
all
of
these
features
to
demonstrate
you
know
compliance
or
adherence
to
these
specific
frameworks.
B
The
third
key
thing
is
showing
proof
of
compliance,
it's
something
that
gives
every
organization
a
headache
and
is
said
to
waste
close
to
26
days
of
a
developer's
time.
Each
year
with
gitlab,
you
can
meet
the
traceability
requirements
for
audits,
such
as
user
actions,
permission
changes,
approval
changes
and
so
on
via
audit
events,
so
we
also
provide
a
consolidated
view
of
various
compliance
signals
in
the
compliance
dashboard,
which
contains
merge,
request
approvals
and
so
on.
B
So,
if
you
look
at
this
chart,
compliance
personnel
spend
a
significant
amount
of
time
generating
reports
for
various
types
of
stakeholders,
so
collation
of
data
and
cost
of
interpreting
the
data
are
highest
among
compliance
costs.
The
other
challenge
is
to
cater
to
the
ever-changing
regulatory
requirements.
B
Updating
systems
to
deal
with
compliance
requirements
and
maintaining
and
reporting
through
these
multiple
systems
is
a
key
pain
point
that
we've
seen
through
some
of
these
reports.
So
with
that
in
mind,
the
gitlab
compliance
dashboard,
that
is
part
of
our
roadmap,
aims
to
provide
compliance.
Insight
in
a
consolidated
view,
with
all
the
relevant
signals,
such
as
segregation
of
duties,
framework
compliance
license
compliance
pipeline
and
mr
results,
the
compliance
dashboard
will
continue
to
evolve.
B
B
To
summarize
compliance
is
all
about
processes
and
outcome.
You
have
to
plan
adequately
for
failure
and
adapt
your
application
for
resilience.
This
means
that
you
have
to
ensure
your
basic
security
and
compliance.
Hygiene
is
in
place.
That
means
you're
not
leaving
any
unprotected
passwords,
unprotected
databases,
and
you
have
policies
defined
for
your
regulations.
B
So,
in
addition
to
supporting
customers
to
build,
secure
and
compliant
applications,
we
also
put
great
effort
in
in
making
sure
that
our
product
itself
is
secure
for
consumption
by
customers.
So
we
are
a
sock
to
type
one
pci
compliant
application.
We
also
address
various
controls
that
are
defined
by
various
regulations,
so
we've
provided
links
to
those.
So
all
of
these
are
summarized
in
our
compliance
webpage.