Towards Automated Continuous Security Compliance

TL;DR

This paper defines continuous security compliance, reviews current challenges through literature, and proposes a research roadmap to advance automation in continuous security compliance for regulated industries.

Contribution

It offers a clear definition, analyzes challenges, and outlines a research roadmap for automating continuous security compliance in software engineering.

Findings

Defined continuous security compliance precisely.

Identified key challenges through literature review.

Proposed a research roadmap for automation.

Abstract

Context: Continuous Software Engineering is increasingly adopted in highly regulated domains, raising the need for continuous compliance. Adherence to especially security regulations -- a major concern in highly regulated domains -- renders Continuous Security Compliance of high relevance to industry and research. Problem: One key barrier to adopting continuous software engineering in the industry is the resource-intensive and error-prone nature of traditional manual security compliance activities. Automation promises to be advantageous. However, continuous security compliance is under-researched, precluding an effective adoption. Contribution: We have initiated a long-term research project with our industry partner to address these issues. In this manuscript, we make three contributions: (1) We provide a precise definition of the term continuous security compliance aligning with the state-of-art, (2) elaborate a preliminary overview of challenges in the field of automated continuous security compliance through a tertiary literature study, and (3) present a research roadmap to address those challenges via automated continuous security compliance.