DevOps Audit Defense Toolkit

As IT organizations increasingly adopt DevOps patterns, there is more tension than ever between IT and audit. These new DevOps patterns challenge traditional thinking about auditing, controls, and risk mitigation. Just as “Dev” and “Ops” need to find new and better ways of working together to help their organization win, so now does IT and audit.

The goal of the DevOps Audit Defense Toolkit is to educate IT management and practitioners on the audit process so they can demonstrate to auditors they understand the business risks and are properly mitigating those risks.

We’ve studied a number of organizations using DevOps and continuous delivery practices that are also subject to various compliance requirements. The Toolkit summarizes the techniques they use to mitigate risk, and also provides a section answering the most common questions about value creation, compliance, and DevOps. The information in this document should help organizations wanting to pursue DevOps and continuous delivery explain their approach and improve communication between IT and audit.