Compliance as Code (CaC)

Go up to Terms and Definitions

Discussion

Compliance as Code (CaC) represents compliance criteria, assessment logic, configuration expectations, remediation instructions, and evidence-generation rules through machine-processable artifacts.

CaC enables automated tools to apply, evaluate, compare, report, and reproduce compliance-related activities within build, deployment, and operational processes.

CaC may include machine-processable benchmarks, profiles, control mappings, policy rules, validation logic, remediation content, evidence templates, and reporting rules.

Within Crucible, CaC supports declaration of a Compliance Posture, automated scanning during an Image Build, normalization of findings, remediation, and generation of reproducible compliance evidence.

Definition

representation of compliance criteria, assessment logic, configuration expectations, remediation instructions, and evidence-generation rules through machine-processable artifacts

Source

Generalized from policy as code, security automation, continuous compliance, machine-processable benchmarks, and configuration management and specialized for the Crucible architecture and operational model.

Note

CaC does not replace governance judgment, legal interpretation, risk acceptance, accreditation, or authorization decisions.

Machine-processable content may implement only part of an applicable compliance obligation. Organizational procedures, human review, external evidence, or contextual interpretation may remain necessary.

Example

A machine-processable Security Technical Implementation Guide (STIG) profile defines configuration checks and remediation content for RHEL 9. Crucible applies the content during an Image Build and produces normalized findings and associated evidence.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.