Compliance adherence in distributed software delivery

Abstract

In this extended abstract, we propose a conceptual framework that leverages distributed ledger technology and smart contracts to create a decentralized system to capture the occurrence of interesting development activities (e.g., a development build) and associated contextual data, and automatically audit and evaluate compliance to governance policies. Our hypothesis is that such a framework will facilitate easier sharing of information across all participants of a distributed development team, compliance evaluation and early mitigation actions, leading to greater visibility and compliance. Currently, the proof of concept we are working on is focused on sharing and compliance evaluation of the open-source components used in software development.