Security & Compliance Engineering
Compliance becomes engineering the moment the auditor asks for evidence and the evidence has to come from a system the developer wrote. Authentication logs, key rotation timestamps, deployment approvals, data-deletion confirmations — every artifact the audit consumes is produced by code, configured by IaC, or absent because nobody decided who owned it. The articles in this collection treat compliance as a control-flow problem in the codebase rather than a document-management problem in SharePoint.
Compliance-as-code content covers the mechanics. Bicep and Terraform modules that enforce the network-isolation and encryption controls instead of leaving them to a reviewer’s checklist. GitHub branch protection and required-reviewer configuration that produce the change-control evidence A.12.1 expects. Dependabot and provenance attestations that satisfy the supply-chain expectations of recent standards without an external scanner stitched on top.
Audit-trail articles focus on what makes a log entry acceptable as evidence. Application Insights with immutable retention, structured logging that survives a schema change without losing correlation, and audit categories separated from operational logs so privacy-relevant events can be retained and queried independently. A log that cannot be queried by control reference during an audit is not an audit trail.
Evidence generation gets explicit treatment. CLI tooling that produces machine-readable compliance verification, health checks that surface privacy-control state alongside operational state, and incident response playbooks codified as GitHub Actions rather than maintained as a Word document nobody opens during the actual incident.
For the ISO/IEC standards that frame most of this content, see the iso-standards tag. The recurring theme here is broader: GDPR, HIPAA, and the ISO family are different vocabularies for the same engineering problem — building systems whose behavior matches their documentation, automatically and continuously.
