Engineering Governance

DevOps &
Compliance

Compliance doesn't have to be a bottleneck. SOC 2, HIPAA, and PCI-DSS each have specific technical controls — automate them into your CI/CD instead of bolting them on at audit time.

SOC 2 Type II

Trust Services Criteria

An AICPA attestation report — not a certification. Type II covers a period of time (usually 6–12 months), proving controls were operative, not just designed. Mandatory for B2B SaaS selling to enterprise.

HIPAA

Protected Health Information

US federal law (45 CFR Parts 160 and 164). The Security Rule mandates technical safeguards for ePHI. All cloud providers processing PHI must sign a Business Associate Agreement (BAA). AWS, GCP, and Azure offer BAAs.

PCI-DSS v4.0

Cardholder Data Security

PCI SSC standard for any system touching cardholder data. v4.0 became effective March 2024. Introduces customised approach allowing alternative controls that meet the stated security objective.

SOC 2 — What DevOps Teams Own

SOC 2 is organised around Trust Services Criteria (TSC). Engineering owns most of the Security criterion (CC6–CC8).

CC6.1–CC6.3

Logical and Physical Access

MFA enforced on all AWS/GCP console and API access — no exceptions for break-glass accounts
IAM roles with least-privilege; no long-lived access keys; rotate secrets via Secrets Manager or Vault
Access reviews quarterly — automate with AWS IAM Access Analyzer or Vanta/Drata
Separate AWS accounts per environment (prod, staging, dev) with AWS Organizations SCPs

CC6.6–CC6.8

Transmission & Encryption

TLS 1.2 minimum on all endpoints; TLS 1.3 preferred — enforce via security policies on ALBs/CloudFront
Encryption at rest: AES-256 via KMS for EBS, RDS, S3, EFS — enforce with AWS Config rule encrypted-volumes
No secrets in environment variables, Dockerfiles, or Git — use AWS Secrets Manager, GCP Secret Manager, or Vault
CloudTrail enabled in all regions with log file validation and 1-year retention in a locked S3 bucket

CC7.2

System Monitoring

Centralise logs: CloudWatch Logs, OpenSearch, or Loki — retain application logs ≥ 90 days, audit logs ≥ 1 year
Alert on anomalous IAM activity with GuardDuty or equivalent CSPM
Kubernetes audit log enabled; ship to SIEM; alert on privilege escalation verbs (impersonate, bind)

CC8.1

Change Management

All production changes via pull request with at least one approved reviewer — no direct commits to main
Deploy pipeline is the only path to production; no manual console changes in prod (enforced by read-only IAM roles for humans)
Terraform plan output stored as audit artifact per deploy
Change freeze windows documented and communicated

Source: AICPA Trust Services Criteria 2017 (updated 2022)

HIPAA — Technical Safeguards (§164.312)

HIPAA mandates addressable or required implementation specifications. "Addressable" means you must implement it or document why an equivalent alternative is used.

Access Control (§164.312(a)(1))

Required

Unique user identification — no shared credentials
Automatic logoff after session timeout
Encryption and decryption of ePHI (AES-256 at rest, TLS 1.2+ in transit)

Audit Controls (§164.312(b))

Required

Hardware, software, and procedural mechanisms to record access to ePHI
Log who accessed what PHI record and when — typically via application-level audit logs
Retain audit logs per your risk analysis (typically 6–10 years)

Integrity (§164.312(c)(1))

Addressable

Implement mechanisms to authenticate ePHI hasn't been altered without detection
Checksums, digital signatures, or hash verification on stored data
Database integrity constraints and immutable audit log storage (WORM S3 or Glacier Vault Lock)

Transmission Security (§164.312(e)(1))

Addressable

Encrypt ePHI in transit — TLS 1.2+ minimum
Do not transmit ePHI over unencrypted channels — no HTTP, no SMTP without STARTTLS
mTLS for service-to-service ePHI flows in microservices

BAAs are mandatory. Before any PHI touches a cloud service (AWS, GCP, Azure, Twilio, Datadog, etc.), a signed Business Associate Agreement must be in place. Storing ePHI on a service without a BAA is a HIPAA violation regardless of encryption.

Source: HHS — HIPAA Security Rule (45 CFR Part 164)

PCI-DSS v4.0 — DevOps-Relevant Requirements

PCI-DSS has 12 Requirements across 6 goals. Below are the ones platform and DevOps engineers directly own. Reduce scope first: tokenise cardholder data and use a payment gateway to minimise what systems enter the CDE.

Req 1 & 2

Network Security & Configuration Standards

Network firewall / security groups: restrict inbound to CDE to only required ports and source IPs — deny all by default
No default vendor passwords on any system component in the CDE
Segment the CDE from non-CDE with a DMZ; document the data flow diagram showing all cardholder data paths
Wireless networks in the CDE: WPA3 or WPA2-Enterprise only

Req 3 & 4

Protect Stored & Transmitted Cardholder Data

Never store Sensitive Authentication Data (CVV2/CVC2, full magnetic stripe) after authorisation — not in logs, not in databases
PAN must be rendered unreadable at rest: one-way hash, tokenisation, or AES-256 encryption with HSM-managed keys
TLS 1.2 minimum for cardholder data in transit — TLS 1.3 strongly preferred; disable SSL, TLS 1.0, TLS 1.1
Validate certificates on all TLS connections; reject invalid certificates in application code

Req 6

Secure Systems and Software Development

Separate development, test, and production environments — no production data in dev/test unless tokenised
All custom code in the CDE reviewed for OWASP Top 10 vulnerabilities before release — SAST in CI, DAST pre-deploy
Web-facing CDE applications must have a WAF (AWS WAF, Cloudflare) in blocking mode or pass a code review confirming no injection flaws
Dependency scanning: third-party libraries patched within defined timelines based on CVSS score

Req 8

Identify Users and Authenticate Access

MFA required for all access into the CDE — v4.0 expands this from admin-only to ALL users
Service accounts and system/application accounts: use strong passwords (≥ 12 chars or MFA), reviewed quarterly
Interactive login sessions time out after ≤ 15 minutes of inactivity
No group, shared, or generic accounts in the CDE

Req 10

Log and Monitor All Access

Audit logs for all CDE system components: user actions, failed logins, privilege escalation, config changes
Protect logs from modification: ship to centralised, immutable log store (WORM S3, managed SIEM)
Retain audit logs: 12 months minimum, 3 months immediately available for analysis
Daily log review — automated anomaly detection in v4.0 replaces purely manual review

Req 11

Test Security of Systems and Networks

Quarterly internal vulnerability scans; quarterly external scans by an Approved Scanning Vendor (ASV)
Annual penetration test of CDE network and application layer; after significant changes
Detect and alert on network intrusions — IDS/IPS on CDE perimeter
File integrity monitoring (FIM) on critical CDE system files and configuration

Source: PCI SSC — PCI-DSS v4.0 (March 2022, effective March 2024)

Controls That Satisfy All Three Frameworks

Automated Audit Trails

Ship CloudTrail, Kubernetes audit logs, and application access logs to a centralised, immutable store. Evidence for SOC 2 CC6/CC7, HIPAA §164.312(b), and PCI Req 10.

Least-Privilege + MFA

IAM roles scoped to minimum required actions, MFA on all human logins. Satisfies SOC 2 CC6.1, HIPAA access control, and PCI Req 8.

Encryption at Rest & In Transit

AES-256 for stored data, TLS 1.2+ for transit. Mandatory for HIPAA, required by PCI Req 3 & 4, and evidence for SOC 2 CC6.7.

Continuous Vulnerability Scanning

SAST in CI, container image scanning (Trivy/Grype), DAST pre-deploy, quarterly network scans. Required by PCI Req 6 & 11, satisfies SOC 2 CC7, and HIPAA risk analysis.

Was this tool helpful?

Need this managed for you, not just automated?

We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.

Explore Our Services

Controls That Satisfy All Three Frameworks

Automated Audit Trails

Ship CloudTrail, Kubernetes audit logs, and application access logs to a centralised, immutable store. Evidence for SOC 2 CC6/CC7, HIPAA §164.312(b), and PCI Req 10.

Least-Privilege + MFA

IAM roles scoped to minimum required actions, MFA on all human logins. Satisfies SOC 2 CC6.1, HIPAA access control, and PCI Req 8.

Encryption at Rest & In Transit

AES-256 for stored data, TLS 1.2+ for transit. Mandatory for HIPAA, required by PCI Req 3 & 4, and evidence for SOC 2 CC6.7.

Continuous Vulnerability Scanning

SAST in CI, container image scanning (Trivy/Grype), DAST pre-deploy, quarterly network scans. Required by PCI Req 6 & 11, satisfies SOC 2 CC7, and HIPAA risk analysis.

DevOps & Compliance

SOC 2 Type II

HIPAA

PCI-DSS v4.0

SOC 2 — What DevOps Teams Own

Logical and Physical Access

Transmission & Encryption

System Monitoring

Change Management

HIPAA — Technical Safeguards (§164.312)

Access Control (§164.312(a)(1))

Audit Controls (§164.312(b))

Integrity (§164.312(c)(1))

Transmission Security (§164.312(e)(1))

PCI-DSS v4.0 — DevOps-Relevant Requirements

Network Security & Configuration Standards

Protect Stored & Transmitted Cardholder Data

Secure Systems and Software Development

Identify Users and Authenticate Access

Log and Monitor All Access

Test Security of Systems and Networks

Controls That Satisfy All Three Frameworks

Automated Audit Trails

Least-Privilege + MFA

Encryption at Rest & In Transit

Continuous Vulnerability Scanning

DevOps & Compliance

SOC 2 Type II

HIPAA

PCI-DSS v4.0

SOC 2 — What DevOps Teams Own

Logical and Physical Access

Transmission & Encryption

System Monitoring

Change Management

HIPAA — Technical Safeguards (§164.312)

Access Control (§164.312(a)(1))

Audit Controls (§164.312(b))

Integrity (§164.312(c)(1))

Transmission Security (§164.312(e)(1))

PCI-DSS v4.0 — DevOps-Relevant Requirements

Network Security & Configuration Standards

Protect Stored & Transmitted Cardholder Data

Secure Systems and Software Development

Identify Users and Authenticate Access

Log and Monitor All Access

Test Security of Systems and Networks

Controls That Satisfy All Three Frameworks

Automated Audit Trails

Least-Privilege + MFA

Encryption at Rest & In Transit

Continuous Vulnerability Scanning

DevOps &
Compliance

DevOps &
Compliance