Frequently asked questions
How does PCI-DSS affect deployment cadence?
PCI-DSS doesn't ban daily deployments — it requires change documentation, segregation of duties, and audit trails. Done right, you can ship multiple times a day and stay PCI compliant. The trick is making your CI/CD pipeline produce the artefacts auditors need (signed builds, change tickets, approver records) automatically rather than as manual paperwork.
Can we ship daily and stay SOC 2 compliant?
Yes. SOC 2 cares about your control environment, not deployment frequency. The audit asks four questions: who approved the change, was the change tested, can you roll it back, who has prod access. A well-designed CI/CD pipeline answers all four automatically. Teams that fail SOC 2 around DevOps usually have ad-hoc deploys, not too-frequent ones.
What's the difference between RBI compliance and SOC 2 for cloud infrastructure?
RBI's IT framework (Master Direction on IT Governance) is more prescriptive than SOC 2 — it mandates specific controls around data localisation, vendor risk management, and incident reporting timelines (6 hours to RBI for major incidents). SOC 2 is principle-based and audit-driven. RBI is rules-based and regulator-driven. Indian fintechs typically need both.
How do you handle secrets in a fintech CI/CD pipeline?
Three rules: (1) no secrets in source code, ever — use HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault with short-TTL rotation; (2) CI runners get scoped, ephemeral credentials via OIDC federation, never long-lived keys; (3) every secret access is logged and reviewable. The fintech-specific addition: dual-control on production secret rotation.
Can DevOps coexist with mandatory change advisory boards (CAB)?
Yes — but the CAB has to evolve. The traditional model (CAB approves every prod change in a Tuesday meeting) breaks at any deploy frequency above weekly. The modern fintech CAB approves change categories (low-risk auto-approved, medium-risk peer-reviewed, high-risk explicit approval), reviews failures retroactively, and operates as a risk-tiering function rather than a per-change gate.