> We're selling into a highly regulated sector looking at ITAR
> Developers love this because they don't have "mother may I" IT for every tool and library.
And herein lies the friction. Someone is going to walk away from this unhappy. It's either going to be the developers or the compliance teams (and then the customers).
We are a ~10 person company selling software to US financial institutions. Really important software that is responsible for things like filling out legal documents that are not feasible for humans to review every time. For us, compliance/security is basically the #1 product feature. Clearly, with 10 people we don't have a lot of bandwidth for running audits or getting into disputes with our customers' compliance teams over whether or not a QA server's disk is encrypted and using the appropriate key rotation schedules.
What we did is decide to get all the way into the rabbit hole with Microsoft. Like 100% of the way. I know - many things they do really really suck - but the compliance offerings and industry perception they provide are nearly unbeatable (at least for our fintech customers). If you compose your product/service exclusively from components that are compliant [0], you will not necessarily be compliant-by-default but this is a hell of a lot better than any other starting point I've seen. AWS and GCP have similar offerings, but there are other considerations with these vendors for our business.
At the end of the day, making an audit easier is about proving you have less control and trust fewer parties than you would otherwise desire to. In our case, subjecting ourselves to actually having less control and fewer vendors was the best way to achieve this. When you can't touch or see things, compliance usually can't hold you accountable for them anymore. It really is a "game" and you can certainly play it to win.
To be clear - our day to day operations are wonderful. We don't have to screw with janky Citrix-style remote desktops and other security theatrics precisely because we are so aggressively using cloud native resources to prove that we are playing by the rules. Now, if you are a 100 or 1000+ person company, I think there are a lot of different things you could consider. Getting into bed with Microsoft at 10 employees was the only rational thing we could come up with.
Strategically, if you intend to do business with customers encumbered by ITAR, et. al., then you had better be prepared to radically shift your product technology to align with those compliance requirements. Following these rules really sucks but your ability to easily comply with them can become a serious competitive edge. Imagine your competitors willingness to sacrifice technological principles (i.e. "fuck Microsoft") in order to beat you to market. This helped cure me of my cargo cult tendencies pretty quickly.
[0]: https://learn.microsoft.com/en-us/compliance/regulatory/offe...