Why compliance work keeps tripping up developers

Compliance often feels like an obstacle to developers who prize flexibility and speed. But it exists for a reason: software must run across regions and organizations with varying security, data, and privacy rules. GitHub, which hosts code for 100 million developers and 90% of the Fortune 100, has experience balancing these business requirements with developer productivity. The key is setting up compliance infrastructure that doesn't grind workflows to a halt.

A more developer-friendly way to think about compliance comes from the concept of an Office of Compliance (OoC). Instead of focusing on coercion or rigid rule-following, an OoC defines compliance as "the desired set of outcomes to achieve and the process by which systems must be validated before they can be deployed to production environments." That framing makes compliance about reaching a defined ideal state, not just avoiding punishment.

Three foundations for a workable compliance program

Before worrying about specific regulations or audit frameworks, it is worth getting the basics right. These three foundational areas will shape everything that follows.

Know your codebase and your developers

You cannot enforce compliance on code you do not know about or developers you cannot see. If your code lives in a central platform like GitHub, this is largely handled for you. If your tooling is scattered, you will need to manually inventory every tool in use and identify every developer with access to those tools — a time-consuming process that is unlikely to produce a complete picture.

Control access with the CIA Triad in mind

Code is among an organization's most sensitive assets, so access control is a core compliance concern. The CIA Triad provides a useful framework:

  • Confidentiality: only authorized users can access information.
  • Integrity: no unauthorized user can alter or interfere with data.
  • Availability: authorized users have dependable access when needed.

On GitHub, these principles map to concrete features. Access permissions on repositories and resources follow the least-privilege model, so users only see what their job requires. The enterprise account model centralizes access management, allowing integration with existing identity providers and synchronized teams. Guardrails set at the enterprise level create a consistent, secure baseline. GitHub also publishes monthly availability reports, a commitment to keeping code accessible when developers need it.

If your toolchain has become unwieldy, consolidating onto a single platform like GitHub Enterprise can cut management overhead significantly.

Plan for periodic user attestation

Knowing who has access today is not enough. You need a process to periodically re-verify that access. Employees change roles or leave, and provisions for revoking their access must be in place. Future work can automate user attestation using GitHub Actions and pull requests, integrating compliance checks directly into existing developer workflows.

Moving from one-time checks to continuous compliance

Just as CI/CD brought speed to software delivery, the same principle applies to compliance. The goal is to make compliance testing and audits as fast and seamless as a DevOps pipeline. Continuous compliance does not arrive overnight, but the groundwork described above brings three major benefits:

  1. No surprises. When audits begin, you will not be scrambling to produce artifacts that were never collected.
  2. Common understanding. The DevOps Audit Defense Toolkit emphasizes educating IT teams on the audit process so they can demonstrate they understand business risks. Better communication between technologists and auditors leads to more efficient audits and, according to Forrester, substantial cost savings.
  3. Built-in compliance. If controls are designed into the software delivery lifecycle from the start, developers meet requirements and generate artifacts as part of their daily routine.

There is also potential for AI to support continuous compliance. GitHub already uses machine learning to find security vulnerabilities, and similar approaches are emerging in manufacturing auditing and banking fraud detection. The application of AI to compliance is promising, though it is still an evolving area.

Once these foundations are in place, the next challenge is implementation: practical ways to meet compliance needs without sacrificing developer agility.