Compliance As Code: GRC Engineering for Continuous Authorization

Federal compliance has long depended on manual evidence collection, point-in-time snapshots and spreadsheets that are outdated the moment they're produced. This session examines how GRC engineering reframes authorization as a software discipline, replacing screenshot-and-spreadsheet workflows with automated evidence pipelines, control-as-code and OSCAL-native artifacts. Attendees will see how agencies and cloud providers are using infrastructure-level automation to generate continuous, audit-ready evidence and what it takes to stand up a pipeline that holds up under assessment.