We are thrilled to announce 📢 Kosli is now SOC 2 Type 2 compliant - Read more
New Feature: Kosli Trails is liveCreate comprehensive audit trails for any DevOps activity - Read more
Kosli devops change management Release Compliant Software on Demand

How To Release Compliant Software on Demand

Mike Long
Author Mike Long
Published March 9, 2021 in technology
clock icon 4 min read

In this blog we’ll explain how to automate the change and release compliance in a Secure Software Development Lifecycle. Kosli is a new technology that enables teams in regulated industries, like fintech, to release compliant software on demand.

Software in regulated industries

The modern world runs on financial transactions, air traffic control, insulin pumps, and car braking systems. When technology becomes critical to our lives and our economies there is increased demand from customers and regulatory bodies to control associated risks.

To meet these requirements, organizations must define software development processes that ensure that safety and security risks are managed in a professional and repeatable manner.

compliant software on demand

Having defined and implemented a process, it is critical to document proof that the process is being followed. It is this evidence that auditors and bodies like the FCA use to ensure that your organization is compliant with the regulations.

The Bottleneck Problem

Regulated software development processes require many activities like version control practices, code review, security scanning, testing, and more. Typically, these activities are spread over several software systems.

This makes it hard to know if the compliance process is being followed and to know what to do if/when compliance steps are missed. Eventually, this creates a headache when it’s time for release and audit. Gathering the data to prove compliance is a manual, costly, time-consuming process. It’s also shown to be poor at mitigating risk and insider threat.

software delivery process

As software takes an increasingly central role in the success of all types of businesses, the demand to deliver more frequently increases the pressure on innovation cycle times.

For regulated industries like fintech, this creates a change management bottleneck at the end of the software delivery cycle. The challenge we face is overcoming the manual and bureaucratic processes that worked well in the past, but are no longer fit for purpose in today’s dynamic software development environments.

Breaking the DevOps Compliance Barrier

Research at DevOps Research Assessment (DORA) proves that today’s best performing technology organizations practice DevOps. However, meeting compliance requirements with DevOps demands a new approach. How do we release complaint software every day when our change management regime forces us to batch changes for release once every 3-6 months? How do we reconcile rapid software delivery with onerous change management processes?

Most regulations are written for general guidance and don’t specify an exact recipe to follow. To comply, organizations have traditionally implemented manual documentation and gate-checks, with every software release documenting the proof that the agreed processes have been followed.

Kosli provides a way of automating all the documentation and checkpoints necessary to comply with regulations.

How does Kosli work?

Kosli is a special type of database for recording your software process automatically. It provides an API for recording various compliance events such as build, code review, security scan, or release, directly from your DevOps pipelines. Implementing this central system of record provides insight across the organization, giving development, operations, security and risk a shared view of compliance.

An important consideration when choosing how to store this data is how it will be used. When the goal is to prove compliance with a software process, it is essential that the data is stored using a provable, secure, tamper-proof method.

DevOps Compliance Journal
Automated Provable Audit Trail
API-Based Secure System of Records
Silo-Breaking Process Aware Append-Only

Storing information in a way that allows for untraceable modification is pointless. This is why Kosli is based on an append-only datastore. It allows new versions of data to be added without losing the history. It is only with this non-modification guarantee that compliance can be proven.

Having a Kosli means you can begin the journey to Continuous Compliance by automating change and release controls.

Change Control

The first step in automating your software process compliance is to start recording the audit trail in your DevOps pipeline. The DevOps pipeline is the best place to do this because it is the heartbeat of software change.

By recording the relevant data in your DevOps pipeline you can query it for change control. How this is implemented depends on your process, but it could be a pre-merge control, or an artifact promotion control. However you approach this, the end result is the same: all changes in your software are automatically compliant with your process.

change control process

Now you have your software change process under control the next step is to manage the release process.

Release Control

Most software releases are made up of a collection of individual changes. The challenge this imposes on regulated software teams is proving that all of the changes included in a release have followed a specified process.

Kosli provides aggregate and composite views of change. This enables all stakeholders to share a common view of compliance across development, test, security, internal and external audit, automatically.

compliant software on demand graphic

Continuous Compliance with Kosli

Delivering at pace within a safe, secure, and repeatable process puts demands on regulated industries. But, by implementing Kosli, teams in these regulated verticals can unlock much more of their DevOps potential 🙌


ABOUT THIS ARTICLE

Published March 9, 2021, in technology

AUTHOR

Stay in the loop with the Kosli newsletter

Get the latest updates, tutorials, news and more, delivered right to your inbox
Kosli is committed to protecting and respecting your privacy. By submitting this newsletter request, I consent to Kosli sending me marketing communications via email. I may opt out at any time. For information about our privacy practices, please visit Kosli's privacy policy.
Kosli team reading the newsletter

Got a question about Kosli?

We’re here to help, our customers range from larges fintechs, medtechs and regulated business all looking to streamline their DevOps audit trails

Contact us
Developers using Kosli