Compliance work tends to stall in the same place. A requirement gets filed on the security team's board, and the people who could actually change the payments service never see it. Three quarters later an auditor asks for proof, and the team learns that "we do this" and "we can show this" are t...
Source: [Dev.to](https://dev.to/krishna_y/dora-and-nis2-as-code-policy-as-code-compliance-evidence-for-spring-boot-on-kubernetes-o0b)