Compliance as a Service

[kevingentile]

In an effort to motivate participation, I propose that authors should consider structuring any requirements in a format that would enable an automated test suite to measure and certify compliance.

Below are projects across various technology domains which provide compliance oriented testbeds:

• cncf/k8s-conformance
• google/x509test
• usnistgov/macos_security
• prometheus/compliance
• ThalesGroup/riscv-compliance
• terraform-compliance/cli
• OpenSCAP/openscap
• google/openpgp-interop

[jwise-mfg]

Yup, this is a good idea. The Working Group kicked-off today and discussed scope that will include an API test endpoint and client. A test suite makes sense too, marking as a feature request for consideration.