Introducing Continuous Compliance with Merkely
Introducing Continuous Compliance with Merkely

Introducing Continuous Compliance with Merkely

In this article we introduce new technology that allows you to automate the change and release compliance in a Secure Software Development Lifecycle. It’s called Merkely, a DevOps Change Collaboration tool for teams in regulated industries.

Delivering software in regulated industries

First, let’s look at the problem we’re solving. The modern world depends on financial transactions, air traffic control, insulin pumps and car braking systems. When technology becomes critical to our lives and our economies there is increased demand from customers and regulatory bodies to control these risks.

In order to meet these requirements, organizations must define software development processes that ensure that safety and security risks are managed in a professional and repeatable manner.

Having defined and implemented a process, it is critical to document proof that the process is being followed. It is this evidence that auditors inspect to ensure that the organization is compliant with the regulations.

Software is eating the world

Regulated software development processes require many activities like version control practices, code review, security scanning and testing. Typically, these activities are spread over several software systems.

This makes it hard to know if the compliance process is being followed and to know what to do if/when compliance steps are skipped. Eventually, this creates a headache when it’s time for release and audit.

As software takes an increasingly central role in the success of all types of businesses, the demand to deliver more frequently increases the pressure on innovation cycle times.

For regulated industries, the challenge they face is overcoming the manual and bureaucratic processes that worked well in the past.

Accelerating with DevOps

Through a combination of culture, automation, lean, measurement, and sharing changes, DevOps enables today’s best performing technology organizations. However, meeting compliance requirements with DevOps demands a new approach.

Most regulations are written for general guidance and don’t specify an exact recipe to follow. In order to comply, organizations have traditionally implemented manual documentation and gate-checks, with every software release documenting the proof that the agreed processes have been followed.

Merkely provides a means of automating all of the documentation and checkpoints necessary to comply with regulations.

Change Collaboration

In short, Merkely records your software process automatically. It provides an API for recording various compliance events such as build, code review, security scan, and release directly from your DevOps pipelines. Implementing this central system of record provides insight across the organization, giving development, operations, security and risk a shared view of compliance.

An important consideration when choosing how to store this data is how it will be used. When the goal is to prove compliance with a software process, it is essential that the data is stored using a provable, secure, tamper-proof method.

Storing information in a way that allows for untraceable modification is pointless. This is why Merkely is based on an append-only datastore. It allows new versions of data to be added without losing the history. It is only with this non-modification guarantee that compliance can be proven.

Change Control

The first step in automating your software process compliance is to start recording the audit trail in your DevOps pipeline. The DevOps pipeline is the best place to do this because it is the heartbeat of software change.

By recording the relevant change control data in your DevOps pipeline you can query it for change control. How this is implemented depends on your process, but it could be a pre-merge control, or an artifact promotion control. However you approach this, the end result is the same: all changes in your software are automatically compliant with your process.

Now you have your software change process under control the next step is to manage the release process.

Release Control

Most software releases are made up of a collection of individual changes. The challenge this imposes on regulated software teams is proving that all of the changes included in a release have followed process.

Merkely provides aggregate and composite views of change. This enables all stakeholders to automatically share a common view of compliance across development, test, security, internal and external audit.

Continuous Compliance with Merkely

Delivering at pace within a safe, secure, and repeatable process puts extra demands on regulated industries. Merkely solves the compliance bottleneck by producing a cryptographically secure, version-aware record that fits into your existing ways of working. Ultimately, it means regulated teams can unlock much more of their DevOps potential by releasing continuously compliant software.

Curious? Try Merkely for free

Top Articles

The Jan Bosch Interview: The Future for Technology Companies

10 outdated beliefs about software

The Jan Bosch Interview: Software Innovation in Embedded and Regulated Systems

Published February 22, 2021 in
Michael Long
Michael Long

Subscribe to The Merkely Meteor for all the latest news, updates and ch-ch-changes

Subscribe to the Merkely Meteor

More posts in technology

How to automate a secure chain of custody across your pipelines in 5 steps

Imagine you’re a Fintech CTO 🤓 with several teams and tens of microservices. Do you know what’s currently running in prod? How about yesterday? A week ago? Last month? And if you do know what’s in prod, do you also know how it got there?

How To Release Compliant Software on Demand

In this blog we’ll explain how to automate the change and release compliance in a Secure Software Development Lifecycle. Merkely is new technology that enables teams in regulated industries, like fintech, to release compliant software on demand.

How to Ensure Software Provenance. Just like Google.

Google has always been a leader when it comes to security culture, and google’s approach to managing a secure development lifecycle is no exception. This article introduces Google’s Binary Authorization for Borg (BAB), and will show you how you can implement the same binary authorization system to ensure that production software and configuration deployed in your organization is properly reviewed and authorized.