* [Topics](/en/topics "Topics") * [Security](/en/topics/security "Security") * What is compliance management? What is compliance management? ============================== Published March 1, 2023•*3*-minute read Copy URL Jump to section --------------- OverviewHow to manage complianceChallengesBest practices and toolsWith Red Hat Overview -------- Compliance management is the ongoing process of monitoring and assessing systems to ensure they comply with industry and security standards, as well as corporate and regulatory policies and requirements. [Automate your compliance management](/en/engage/solp-security-automation-101-ebook-s-202007140458 "SOLP: Simplify your security operations center") How to manage compliance ------------------------ This involves infrastructure assessment to identify systems that are noncompliant due to regulatory, policy, or standards changes, misconfiguration, or any other reason. Compliance management is important because noncompliance may result in fines, security breaches, loss of certification, or other damage to your business. Staying on top of compliance changes and updates prevents disruption of your business processes and saves money. To successfully monitor and manage compliance for your business’s infrastructure, you’ll need to: * **Assess:** Identify systems that are noncompliant, vulnerable, or [unpatched](/en/topics/management/what-patch-management-and-automation). * **Organize:** Prioritize remediation actions by effort, impact, and issue severity. * **Remediate:** Quickly and easily patch and reconfigure systems that require action. * **Report:** Validate that changes were applied and report change results. Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") Compliance management challenges -------------------------------- A few things that can make compliance management difficult are: * Changing [security](/en/topics/security) and compliance landscapes: Security threats and compliance changes evolve quickly, requiring rapid response to new threats and evolving regulations. * Distributed environments across multiple platforms: As infrastructures become more distributed across on-site and [cloud platforms](/en/topics/cloud-computing), it becomes more difficult to get a complete view of your environment and any risks and vulnerabilities that might be present. * Large environments and teams: Large, complex infrastructures and teams can complicate coordination across your environment and organization. In fact, system complexity can increase the cost of a data breach. Compliance best practices and recommended tools ----------------------------------------------- The best way to meet each of these challenges is with a multifaceted approach that will monitor all environments, identify any regulatory inconsistencies, address those inconsistencies and bring them up to date and into compliance, and keep a record of these updates. These best practices can help you stay abreast of any regulatory changes and keep your systems compliant: 1. **Regular system scans:** Daily monitoring can help you identify compliance issues, as well as security vulnerabilities, before they impact business operations or result in fees or delays. 2. **Deploy** [**automation**](/en/topics/automation)**:** As the size of your infrastructure grows and changes, it becomes more challenging to manage manually. Using automation can streamline common tasks, improve consistency, and ensure regular monitoring and reporting, which then frees you up to focus on other aspects of your business. 3. **Consistent patching and patch testing:** Keeping systems up to date can boost security, reliability, performance, and compliance. Patches should be applied once a month to keep pace with important issues, and patching can be automated. Patches for critical bugs and defects should be applied as soon as possible. Be sure to test patched systems for acceptance before placing them back into production. 4. **Connect your tools:** Distributed environments often contain different management tools for each platform. Integrate these tools via [application programming interfaces (APIs)](/en/topics/api/what-are-application-programming-interfaces). This allows you to use your preferred interfaces to perform tasks in other tools. Using a smaller number of interfaces streamlines operations and improves visibility into the security and compliance status of all systems in your environment. Some tools that can help are: * **Proactive scanning:** Automated scanning can ensure systems are monitored at regular intervals and alert you to issues without expending much staff time and effort. * **Actionable insight:** Information that is tailored to your environment can help you more quickly identify which compliance issues and security vulnerabilities are present, which systems are affected, and what potential impacts you can expect. * **Customizable results:** Define business context to reduce false positives, manage business risk and provide a more realistic view of your security and compliance status are ideal. * **Prescriptive, prioritized remediation:** Prescriptive remediation instructions eliminate the need to research actions yourself, saving time and reducing the risk of mistakes. Prioritization of actions based on potential impact and systems affected help you make the most of limited patching windows. * **Intuitive reporting:** Generating clear, intuitive reports about which systems are patched, which need patching, and which are noncompliant with security and regulatory policies increases auditability and helps you gain a better understanding of the status of your environment. Compliance and automation with Red Hat -------------------------------------- An automation strategy goes a long way to building capacity for checking systems for compliance without increasing time or cost. Manual compliance practices are more time-consuming, prone to human error, and harder to repeat or verify. Selecting the right automation technologies is key for rapid implementation across the data center and network software systems in hybrid environments. It’s here that Red Hat shines, with a holistic, end-to-end software stack for automation and management that includes [Red Hat® Enterprise Linux®](/en/enterprise-linux-8), [Red Hat Ansible® Automation](/en/technologies/management/ansible), [Red Hat Satellite](/en/technologies/management/satellite), and [Red Hat Lightspeed](/en/lightspeed) (formerly Red Hat Insights). [Continue reading](/en/engage/linux-management-ebook-s-201912231121 "SOLP: Manage your Linux environment for success") Recommended for you E-book The state of Kubernetes security report: 2024 edition ----------------------------------------------------- Read about new, emerging trends in container, Kubernetes, and cloud-native security in this latest edition of the State of Kubernetes security report. [Read the e-book](https://www.redhat.com/en/engage/state-kubernetes-security-report-2024?percmp=RHCTG0250000455234) Recommended for you Developing Advanced Automation with Red Hat Ansible Automation Platform and exam -------------------------------------------------------------------------------- This course teaches you advanced Ansible skills, helping you design, operate, and scale your automation. [View course with exam](https://www.redhat.com/en/services/training/developing-advanced-automation-red-hat-ansible-automation-platform-and-exam-au375?percmp=RHCTG0250000455236) Keep reading ------------ ### What is confidential computing? Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it. [Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?") ### What are SPIFFE and SPIRE? SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems. [Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?") ### Red Hat Enterprise Linux security Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy. [Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security") Security resources ------------------ ### Related content * Case study [The FCCC is making its applications cloud-ready](/en/resources/florida-court-clerks-comptrollers-q-and-a) * Checklist [4 steps in your Red Hat OpenShift security maturity journey](/en/resources/4-steps-openshift-security-maturity-journey-checklist) * E-book [Accelerate outcomes: Do more with Red Hat Services](/en/engage/do-more-with-red-hat-services-ebook) * Overview [Effectively manage deployments in Google Cloud with Red Hat Lightspeed](/en/engage/lightspeed-manage-deployments-in-google-cloud-overview) ### Related articles * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is DevOps automation?](/en/topics/automation/what-is-devops-automation) * [What is IT service management (ITSM)?](/en/topics/automation/what-is-it-service-management-itsm) * [What is Infrastructure as Code (IaC)?](/en/topics/automation/what-is-infrastructure-as-code-iac) * [Ansible vs. Kubernetes: how they work together](/en/topics/automation/Ansible-vs-Kubernetes) * [What is cloud migration? And how can automation help?](/en/topics/automation/what-is-cloud-migration) * [What is a configuration management database (CMDB)?](/en/topics/automation/what-is-a-configuration-management-database-cmdb) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is a software-defined data center (SDDC)?](/en/topics/automation/what-is-a-sddc) * [What is IT automation?](/en/topics/automation/what-is-it-automation) * [Why choose Red Hat Ansible Automation Platform as your AI foundation?](/en/topics/automation/automation-and-ai) * [How to build an IT automation strategy](/en/topics/automation/build-an-automation-strategy) * [What is access control?](/en/topics/security/what-is-access-control) * [What is virtual infrastructure management? And how can automation help?](/en/topics/automation/virtual-infrastructure-management) * [What is IT migration?](/en/topics/automation/what-is-it-migration) * [How to automate migrations with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/automate-migrations-with-red-hat-ansible-automation-platform) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [What is a CVE?](/en/topics/security/what-is-cve) * [What is CloudOps?](/en/topics/automation/what-is-cloudops) * [Red Hat Satellite on Red Hat Enterprise Linux](/en/technologies/management/satellite/satellite-for-rhel) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Which Red Hat Ansible Automation Platform deployment option is right for you?](/en/technologies/management/ansible/ansible-deployment-options) * [What is an Ansible module—and how does it work?](/en/topics/automation/what-is-an-ansible-module) * [How to manage and automate applications at the edge](/en/topics/edge-computing/how-to-manage-automate-applications-edge) * [How to build an automation Center of Excellence](/en/topics/automation/how-to-build-automation-center-of-excellence) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [What is orchestration?](/en/topics/automation/what-is-orchestration) * [How to adopt Automation as Code: Extending Infrastructure as Code into Policy as Code](/en/topics/automation/how-to-adopt-automation-as-code) * [What is a webhook?](/en/topics/automation/what-is-a-webhook) * [Learning Ansible basics](/en/topics/automation/learning-ansible-tutorial) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is an Ansible Role—and how is it used?](/en/topics/automation/what-is-an-ansible-role) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [What is data management?](/en/topics/data-services/what-is-data-management) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is NetOps?](/en/topics/automation/what-is-netops) * [What is an Ansible Rulebook?](/en/topics/automation/what-is-an-ansible-rulebook) * [What is an Ansible Playbook?](/en/topics/automation/what-is-an-ansible-playbook) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is configuration management](/en/topics/automation/what-is-configuration-management) * [What is event-driven automation?](/en/topics/automation/what-is-event-driven-automation) * [Zero-Touch Provisioning and telco automation with Red Hat](/en/topics/telecommunications/zero-touch-provisioning-and-telco-automation-at-red-hat) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is infrastructure automation?](/en/topics/automation/what-is-infrastructure-automation) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is YAML?](/en/topics/automation/what-is-yaml) * [What is provisioning?](/en/topics/automation/what-is-provisioning) * [Understanding Ansible, Terraform, Puppet, Chef, and Salt](/en/topics/automation/understanding-ansible-vs-terraform-puppet-chef-and-salt) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud orchestration?](/en/topics/automation/what-is-cloud-orchestration) * [Ansible vs. Chef: What you need to know](/en/topics/automation/ansible-vs-chef) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [Ansible vs. Salt: What you need to know](/en/topics/automation/ansible-vs-salt) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [What is a configuration file?](/en/topics/linux/what-configuration-file) * [Ansible vs. Puppet: What you need to know](/en/topics/automation/ansible-vs-puppet) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [Ansible vs. Terraform, clarified](/en/topics/automation/ansible-vs-terraform) * [Why choose Red Hat for automation?](/en/topics/automation/why-choose-red-hat-for-automation) * [Ansible vs. Red Hat Ansible Automation Platform](/en/technologies/management/ansible/ansible-vs-red-hat-ansible-automation-platform) * [What is cloud automation?](/en/topics/automation/what-is-cloud-automation) * [What is network automation?](/en/topics/automation/what-is-network-automation) * [What are managed IT services?](/en/topics/cloud-computing/what-are-managed-it-services) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [What is business process management?](/en/topics/automation/what-is-business-process-management) * [What is patch management (and automation)?](/en/topics/management/what-patch-management-and-automation) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is the Red Hat Ansible Automation Platform automation controller?](/en/technologies/management/ansible/automation-controller-product-feature) * [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security) * [What is SOAR?](/en/topics/security/what-is-soar) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [What is business process automation?](/en/topics/automation/what-is-business-process-automation) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [What is IT process automation?](/en/topics/automation/what-is-it-process-automation) * [Automating Microsoft Windows with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/automate-microsoft-windows-with-ansible) * [What is deployment automation?](/en/topics/automation/what-is-deployment-automation) * [What is business optimization?](/en/topics/automation/business-optimization) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is SRE?](/en/topics/devops/what-is-sre) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is network management?](/en/topics/management/what-is-network-management) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is an SOE?](/en/topics/management/what-is-an-soe) * [What is IT system life-cycle management?](/en/topics/management/it-system-life-cycle-management) * [What is API security?](/en/topics/security/api-security) * [What is robotic process automation (RPA?)](/en/topics/automation/what-is-robotic-process-automation) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) * [What is cloud management?](/en/topics/cloud-computing/what-is-cloud-management) * [What's business automation?](/en/topics/automation/whats-business-automation) [More about this topic](/en/topics/security "More about this topic")