Compliance means adhering to applicable laws, regulations, policies, and prescribed controls. In platform engineering, it must provide organizational assurance without making software delivery harder than necessary. Treating each requirement as a separate handoff to a stakeholder team can preserve the friction the platform is meant to remove. section 4.0
Assign responsibility before choosing controls:
- The platform team is directly responsible for the platform’s own security and compliance requirements. section 1.3.3
- Developers remain responsible for their applications. The platform can provide capabilities that help them assess code and identify known vulnerabilities, but it cannot make insecure code secure automatically. section 1.3.3
- Keep compliance work distinct from compliance verification when designing governance processes. section 4.0
Turn stakeholder requirements into platform decisions
A security team may require that attackers cannot reach known, exploitable critical vulnerabilities; an audit team may require nonterminable evidence of every deployment for SOX compliance; Infosec may require authorized-only access to sensitive dataset APIs. Each requirement needs an implementation owner and a way to demonstrate that it is met. Handing all implementation back to separate stakeholder teams risks recreating developer roadblocks. section 4.0
Start with essential security services on every cluster, then evolve security, compliance, and governance into automated, integrated parts of the platform experience. The aim is assurance that remains in place as adoption grows, without turning routine platform use into a compliance obstacle. section 8.2.1
