Most organisations experience compliance as an event: a frantic period before an audit, screenshots gathered, spreadsheets updated, a posture briefly hoisted to standard and then allowed to drift. It is exhausting, expensive, and — worst of all — it proves very little about the other fifty weeks of the year. There is a better way, and it starts by treating configuration as code.
When you harden systems with Ansible, every configuration becomes a reviewable, version-controlled artefact. A CIS or STIG benchmark stops being a PDF someone is meant to follow and becomes a set of playbooks that enforce the baseline, repeatably, across the whole estate. The difference this makes to compliance is profound, and it shows up in three ways.
First, consistency
A benchmark applied by hand is applied differently on every system and drifts the moment someone logs in to “just fix one thing.” A benchmark applied as code is identical everywhere and re-asserted every time it runs. “Are all our servers hardened to CIS?” changes from a hopeful guess to a fact you can demonstrate.
Second, the audit trail
Because the configuration lives in version control, every change is attributed, dated, reviewed, and reversible. When an auditor asks “who changed this control, when, and why?”, the answer is a commit — not an archaeology project across ticketing systems and memories. Evidence is generated by construction, not reconstructed under pressure.
Third, remediation speed
When a benchmark updates or a misconfiguration is found, you change the code once and roll it out everywhere, verifiably. Drift is corrected by re-running the playbook, not by chasing individual machines.
You cannot prove the posture of assets you don't know about
Underneath this sits one more piece: you cannot prove the posture of assets you don't know you have. That is why we pair automation with GLPI as a single, auditable record of every asset, its configuration, and its changes. Code enforces the baseline; the CMDB proves the scope.
Compliance as a property, not a performance
The result reframes compliance entirely. Instead of a periodic performance staged for an auditor, assurance becomes a continuous property of how the systems are built and operated. Frameworks like ISO 27001, Cyber Essentials Plus, and the NCSC CAF get easier to satisfy not because you work harder before the audit, but because the evidence they ask for is a natural by-product of doing the engineering properly.
That is the quiet advantage of infrastructure-as-code: it turns compliance from theatre into fact.