Security · Flashcard
What does compliance as code express that a scheduled scan alone does not?
- AThe control itself as a versioned artifact that can be diffed, reviewed and tested
- BThe scan schedule as a cron definition stored beside the application source code
- CThe findings as structured output a dashboard can aggregate across many systems
- DThe control catalogue as a spreadsheet exported from the governance tooling
Why this is the answer
Compliance as code moves the control definition itself into version control, where it gets a diff, a review and a test like any other code — OSCAL does the same for catalogues, baselines and system security plans. Automating when the scan runs only schedules a detective control. Structured findings improve reporting but describe outcomes, not the control. And exporting the catalogue to a spreadsheet produces a document, which is the manual practice this replaces.
Official docs