一句话：指出现有合规认证依赖人工审计源代码，成本高、易错、不完整且易回归，主张以持续自动化检查替代。
本文关注大型企业与政府供应商所需的合规认证问题。目前行业标准是由审计员手工审计源代码来证明软件满足 SOC、PCI DSS 等合规制度，以保护敏感数据的隐私与安全。这种手工审计成本高、易出错、覆盖不完整，且难以防止回归。摘要未详述具体方法，但从标题“持续合规”可推断，论文主张以持续、自动化的合规检查替代一次性人工审计，从而降低成本、提高覆盖率并避免回归。评估方面摘要未提供信息。
Vendors who wish to provide software or services to large corporations and governments must often obtain numerous certificates of compliance. Each certificate asserts that the software satisfies a compliance regime, like SOC or the PCI DSS, to protect the privacy and security of sensitive data. The industry standard for obtaining a compliance certificate is an auditor manually auditing source code. This approach is expensive, error-prone, partial, and prone to regressions.
DOI 原文 ·
@inproceedings{paperbot5929,
title = {Continuous compliance},
author = {Martin Kellogg and Martin Schäf and Serdar Tasiran and Michael D. Ernst},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3416593}
}