Author: Anca Sailer

In part 1 of this multi-part blog series on continuous compliance, we detailed the personas and their role in the compliance processes. We concluded that the key to achieving compliance automation and hence continuous compliance is the compliance artifacts programmatic representation, as code, expressed in generic and standard security language terms.

In this blog post, we introduce Trestle, our open-source implementation of the NIST Open Security Control Assessment Language (OSCAL) standard framework adopted as a workflow automation of compliance artifacts managed as compliance as code. Trestle enables those diverse personas to collaboratively author the compliance artifacts and offers a platform and OSCAL SDK for teams to automate their specific native processes and formats. Trestle implicitly provides a core opinionated workflow driven by its pipeline to allow standardized interlocks with other compliance tooling platforms.

This is the first part of our series of blog posts illustrating the challenges that organizations and cloud providers face when trying to achieve continuous compliance. The series will provide the key concepts, technologies, and industry standards that lead the way toward an operational, scalable, and effective end-to-end solution.

We will start by introducing the compliance personas and their roles and actions in the compliance processes. Understanding the personas, their roles, and needs is key to the design and architectural decisions for the Governance, Risk, and Compliance (GRC) automation detailed in our follow-up blog posts.