Continuous Compliance

Kind: capability

Layer: Security Core

Record: architecture:continuous-compliance

Severity: contextual

Scope: CI/CD, infrastructure, codebase

Canonical: Ontology

The ability to check compliance on every change, with automated policy gates and evidence capture.

Listed in Architecture principles, after Risk Management and before CSRF Protection.

Requires

• Policy as Code
• Evidence Automation

Reinforces

• Compliance
• Auditability

Enables

• Ongoing Assurance

Conflicts with

• Point-in-Time Audit Only

In tension with

• Pipeline Complexity

Tensions

• Continuous Compliance / Pipeline Complexity

Violated by

• Point-in-Time Audit Only

Refactored by

• Automated Enforcement
• Policy as Code

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Linked from

• Observability / Auditability / Traceability
• Security / Privacy / Compliance / Governance
• Core Vocabulary
• Security Privacy Compliance
• Severity levels
• The resolutions