Compliance and Regulatory Adherence

All courses / Architecture as Code / Module 3 / Chapter 12

Learning objectives

After the lesson the participant can:

• Describe the five stages of the compliance loop with the outputs and feedback of each.
• Explain how the Control Mapping Matrix puts assure once, comply many into operation.
• Trace a compliance requirement through functional control, code artefact and verification activity.
• Distinguish current-state requirements from the topics the chapter labels as speculative.

Key concepts

Compliance loop

A closed feedback loop of five stages: regulatory intelligence, policy template creation, automated control execution, monitoring and evidence collection, and governance reinforcement, which informs the next cycle of regulatory intelligence.

Control Mapping Matrix

One reusable matrix that links each control identifier to the assurance artefacts captured in CI and to the external frameworks they satisfy, replacing bespoke spreadsheets for each framework.

Requirements traceability

Demonstrable links from business, compliance, performance and cost requirements to functional controls such as encryption, network segmentation and audit logging, to the Terraform configuration that implements them and the test suites that validate them.

AI as a triage layer

An AI compliance engine that ingests telemetry, policy breaches and regulator feedback to classify incidents, enrich them with evidence and recommend automation or escalation paths, with human oversight in the loop.

Crypto-agility baseline

A configuration that still relies on classical algorithms but keeps keys and certificates rotatable, so that post-quantum alternatives can be adopted when services expose them. The chapter files quantum readiness under speculative considerations.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Which stage of the compliance loop is weakest in your organisation, and what breaks downstream because of it?
2. The chapter limits the AI layer to triage and keeps human oversight in the loop. What tasks would you be comfortable assigning to it, and which not?
3. What is gained by labelling quantum readiness and sustainability as speculative instead of writing them into today's control baseline?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which control does the worked matrix row SEC-ID-001 record?

   1. Enforce MFA for human identities
   2. Encrypt all storage at rest
   3. Restrict workloads to EU regions
   4. Rotate customer-managed keys annually
   Show the answer

   A. Enforce MFA for human identities
   SEC-ID-001 is titled Enforce MFA for human identities. Its policy module and evidence pipeline execute once and satisfy several attestations, with IAM-01 as the internal catalogue entry.

2. What closes the compliance loop in the chapter's model?

   1. The regulator signs off the complete evidence package at the end of every quarter
   2. Automated controls delete non-compliant resources
   3. Governance reinforcement informs the next regulatory intelligence cycle
   4. The policy templates are archived after each audit
   Show the answer

   C. Governance reinforcement informs the next regulatory intelligence cycle
   The fifth stage, governance reinforcement, produces updated policies, remediation plans and training, and the loop closes as governance informs the next regulatory intelligence cycle.

3. How does the chapter characterise its section on quantum computing readiness and green computing?

   1. As mandatory controls for all regulated organisations today
   2. As forward-looking, exploratory guidance and not current-state requirements
   3. As topics outside the scope of Architecture as Code
   4. As requirements that apply only to public authorities
   Show the answer

   B. As forward-looking, exploratory guidance and not current-state requirements
   The section is headed as speculative and says the topics are exploratory, to be treated as forward-looking guidance rather than current-state requirements.