Compliance-as-Code Engineering

Overview

Compliance evidence has traditionally been a manual, labour-intensive process — someone opens a spreadsheet, takes screenshots, saves files to a shared drive, and hopes the folder is still there when the auditor comes. Compliance-as-Code replaces that with automated, version-controlled pipelines that collect evidence continuously, consistently, and at scale.

The result: when an auditor asks for evidence, you generate the report in minutes, not days.

The Problem with Manual Evidence

Every manual evidence collection step introduces risk: the step is forgotten, the wrong screenshot is taken, the folder gets reorganised, the spreadsheet formula breaks. Over time, evidence gaps accumulate. When an audit arrives, the scramble to reconstruct what happened six months ago is both expensive and unreliable.

The real cost of manual compliance is not just the hours — it is the quality of the evidence when it matters.

What Automation Looks Like

For Microsoft 365, an automated pipeline might:

1. Pull the current Conditional Access policy list from Graph API every morning
2. Record the MFA enforcement status for all users
3. Extract the audit log for privileged role changes over the past 30 days
4. Assemble these into a structured monthly compliance report
5. Commit all evidence to a Git repository with timestamps

This runs without anyone remembering to do it. The evidence is always current, always consistent, and always auditable.

A Simple Example

# Fetch MFA status for all users via Microsoft Graph API
import requests

def get_mfa_status(access_token: str) -> list:
    url = "https://graph.microsoft.com/v1.0/reports/credentialUserRegistrationDetails"
    headers = {"Authorization": f"Bearer {access_token}"}
    response = requests.get(url, headers=headers)
    response.raise_for_status()
    return response.json().get("value", [])

This is one control, automated. We build pipelines covering dozens of controls — tailored to the frameworks you need to evidence.

Handover and Ownership

We do not build black boxes. Every pipeline is documented, every integration explained, every dependency listed. The handover session ensures your team can run it, maintain it, and extend it to new controls as your compliance programme grows. You own the code.