Compliance as Code
Learn the layer between a technical control and the framework an auditor asks about. Controls, evidence and exceptions; CIS Benchmark profiles, kube-bench and OpenSCAP; policy as a preventive gate; audit trails and access reviews; and SOC 2, ISO/IEC 27001 and PCI DSS in practice — remembered with spaced repetition.
- flashcards
- 83
- flashcards
- per day
- ~10 min
- per day
- level
- Intermediate → Advanced
- level
- modules
- 5
- modules
What is compliance as code?
Compliance as code means expressing a control as a versioned, testable artifact rather than a paragraph in a policy document — something that can be diffed, reviewed and proven to have run. The gap it closes is familiar: a standard states an intention and relies on someone remembering it, while an admission webhook or a benchmark scan is the control actually operating, every time, without human attention.
The hard part is not automation, it is knowing what each control does and does not prove. A clean CIS Benchmark scan evidences configuration on the day it ran — not the days between scans, not runtime behaviour, and not the Manual recommendations no scanner can score. An admission policy stops the next non-compliant workload but never touches the ones already running. An audit log establishes that an authorised identity acted, but says nothing about whether they should have. Every one of those gaps is a finding waiting to happen.
This track follows that chain end to end: the vocabulary of controls, evidence, compensating controls and exceptions; measuring state with CIS Benchmark profiles, kube-bench, Trivy misconfiguration scanning and the SCAP toolchain of XCCDF, OVAL and tailoring; enforcing it through Pod Security Admission and Kyverno, with exceptions expressed as reviewable objects rather than edits buried in a rule; the properties that make an audit trail usable as evidence — WORM retention, tamper-evident chaining, change management through Git, access reviews and break-glass; and finally SOC 2, ISO/IEC 27001, PCI DSS, NIST CSF 2.0 and OSCAL as they are actually assessed. The policy engines themselves have their own track: OPA and Gatekeeper covers Rego and the constraint model in detail.
5 modules, seed to bloom
Each module is a set of flashcards — 83 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
Compliance Foundations
Controls, evidence, exceptions and the limits of an audit
16 cardsBenchmarks & Scanning
CIS profiles, kube-bench, Trivy and the SCAP toolchain
17 cardsPolicy Enforcement
Admission gates, Pod Security, Kyverno and shift-left policy
16 cardsEvidence & Audit Trails
Immutable logs, change management and access reviews as evidence
16 cardsFrameworks in Practice
SOC 2, ISO 27001, PCI DSS and mapping controls between them
18 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
What does compliance as code express that a scheduled scan alone does not?
- AThe control itself as a versioned artifact that can be diffed, reviewed and tested
- BThe scan schedule as a cron definition stored beside the application source code
- CThe findings as structured output a dashboard can aggregate across many systems
- DThe control catalogue as a spreadsheet exported from the governance tooling
Why can kube-bench not report control-plane checks on an EKS or GKE cluster?
- AThe provider owns those nodes, so their flags and config files are not reachable
- BThe provider forbids benchmark tooling from running inside a managed cluster
- CThe CIS Kubernetes Benchmark omits control-plane recommendations from its profiles
- DThose recommendations are Manual, so no tool may report a result for them at all
Which requirement does the restricted Pod Security Standard add on top of baseline?
- AContainers must set runAsNonRoot and drop ALL capabilities
- BContainers must not mount hostPath volumes or use the host network
- CContainers must not run privileged or add the CAP_SYS_ADMIN capability
- DContainers must declare CPU and memory limits in every container spec
What can S3 Object Lock in compliance mode do that governance mode cannot?
- ABlock deletion by every user including the account root for the whole retention period
- BApply a default retention period to each new object placed into the bucket automatically
- CHold an object for an unbounded time until an authorised user explicitly releases it
- DProtect an object in a bucket that never had S3 Versioning enabled on it beforehand
What does a SOC 2 Type 2 report cover that a Type 1 does not?
- AWhether the controls operated effectively across a stated period of time
- BWhether the controls were suitably designed to meet the criteria selected
- CWhether the description of the system fairly presents what was actually built
- DWhether the service organisation's assertion was signed by its management
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
Why compliance as code is worth your time
The vocabulary auditors use
Control versus policy, design versus operating effectiveness, compensating control versus customized approach — the distinctions that decide whether an answer lands or costs you a finding.
What a green check does not prove
Point-in-time versus continuous, sample versus full population, configuration versus runtime. Knowing the limits of a control is the difference between evidence and over-claiming.
Verified against primary sources
CIS profile definitions from cisecurity.org, kube-bench semantics from its own source, Pod Security levels from kubernetes.io, PCI terms from the council glossary — not from secondary prep sites.
Mechanics, not slogans
Which three axes a Pod Security exemption uses, what governance mode lets a caller bypass, why a plan-time policy is blind to drift — the details you need to implement this, not just discuss it.
Common questions
What is the difference between a CIS Benchmark and a compliance framework? +
A CIS Benchmark is a prescriptive set of configuration recommendations for one named technology and version — what value a specific setting should hold. A framework such as SOC 2, ISO/IEC 27001 or PCI DSS states outcomes an organisation must achieve and says nothing about how any particular system is configured. Benchmarks are one way to evidence a framework requirement; they are not interchangeable with it.
What does an "Automated" CIS recommendation mean? +
It means the recommendation carries assessment artifacts, so tooling can score it pass or fail without a person inspecting the system. "Manual" means prose only, and a human has to verify it. CIS renamed these from "Scored" and "Not Scored" specifically to put the evaluation method in the name — the status says nothing about whether a remediation script exists.
Why does kube-bench skip control-plane checks on EKS or GKE? +
kube-bench reads API server, scheduler and controller-manager settings from files on the host. On a managed cluster those components run in the provider’s account, so the files are simply not reachable — the project’s own documentation states that inspecting the master nodes of managed clusters is impossible. Worker-node checks still work, which is why separate EKS and GKE job manifests exist.
Is SOC 2 a certification? +
No. A SOC 2 report is an attestation: a CPA firm examines management’s description and assertion and reports an opinion, so there is no certificate and no such thing as being "SOC 2 certified". ISO/IEC 27001 is the certification route, where an accredited body issues a certificate naming a scope — and that scope covers the management system, not a product.
Does this track cover Rego or SBOMs? +
No — deliberately. Rego and the Gatekeeper constraint model live in the OPA track, and SBOMs, provenance and signing live in the software supply chain security track. This one covers the compliance layer above both: which control satisfies a requirement, and what it still leaves unproven.
Is it free? +
Yes, completely free. No registration or credit card is required, and all your progress is stored locally in your browser.
Ready to make your controls provable?
Plant your first seed today. Ten minutes a day turns benchmarks, policy gates and audit evidence from paperwork into controls you can defend.