Continuous Compliance in Regulated Industries: Automating Audit Evidence Collection Across DevOps Pipelines for SOC 2 and ISO 27001

Abstract

Regulated software organisations face growing pressure to demonstrate continuous compliance rather than point-in-time audit readiness, yet most compliance programmes remain manual and episodic. This paper presents ComplianceStream, a pipeline-integrated evidence collection framework that automatically captures, classifies, and archives audit artefacts�build provenance records, access logs, change approval trails, and test results�mapped to SOC 2 Type II and ISO 27001 control families. Deployed across 8 financial services and healthcare organisations, ComplianceStream reduced external audit preparation effort by 73% and eliminated recurring audit findings related to evidence completeness. A control-to-pipeline mapping ontology and a readiness dashboard are contributed, enabling engineering and compliance teams to maintain shared visibility over control coverage in real time.