.png)
Automating Governance: Collaborative Drafting & Risk Cataloging
Stop trading velocity for compliance. You can have both.
Following the success of our previous working sessions in Toronto and London, the Open SDLC Controls Framework working group is gathering in New York for its 4th OSFF interactive working session.
For most financial institutions, "Audit Season" remains a manual, friction-filled process of gathering screenshots and halting deployments. This workshop is designed to change that. Join industry leads Aaron Searle from Morgan Stanley, and Alex Kantor from Kosli to review recent progress, discuss the ongoing standards project, and collaboratively draft key risks and mitigations directly into the Controls Catalog.
WORKSHOP DESCRIPTION
In regulated industries, delivering software quickly and securely requires a delicate balance between enterprise policy and developer experience. Building on the momentum of Common Cloud Controls and the AI Governance Framework, this initiative provides a shared, technology-agnostic vocabulary for SDLC controls that the entire industry can adopt.
This New York session represents an active working milestone. We will move beyond high-level theory into the technical "brass tacks" of governance. Participants will engage in interactive working sessions to review, refine, and collaboratively draft risks and mitigations in the Controls Catalog—bridging the gap between what an auditor requires and what a CI/CD pipeline executes.
- Facilitators: Aaron Searle, Morgan Stanley & Alex Kantor, Kosli
WHO SHOULD ATTEND?
This session is designed to bring the "Three Lines of Defense" together:
- DevOps & Platform Architects: Who want to build "Golden Paths" with compliance built-in, not bolted on.
- Internal Audit (Tech) Leads: Who are moving toward continuous monitoring and automated evidence.
- Risk & Compliance Officers: Who need to map SDLC controls to global regulations (DORA, NIST, SSDF).
- Engineering Managers: Who want to reduce the "Audit Tax" on their delivery teams.
What You Will Walk Away With:
- Direct Catalog Contributions: Hands-on experience collaboratively drafting risks, controls, and mitigations into the Open SDLC Controls Catalog.
- Testing & Deployment Gates: Strategies to codify requirements for automated vs. manual test evidence and implement gates that prevent non-compliant code from reaching production.
- Service & Tooling Standardization: Insights into mapping service dependencies and defining common tools inventories for CI/CD environment reproducibility and provenance.
- Active Working Group Alignment: Direct access to project leaders to align the framework with your bank's specific regulatory and operational needs.
What You Will Walk Away With:
- Laptop Required: For reviewing framework documentation and live pull requests.
- Domain Knowledge: Familiarity with CI/CD concepts, GitHub/GitLab workflows, or IT Risk Management frameworks (NIST/ISO) is highly recommended.
Logistics & Application
- Date: Tuesday, November 3, 2026
- Time: 9:00 AM – 12:00 PM EST
- Location: New York (Venue details provided upon acceptance)
- Cost: Free for approved applicants (Standard Value: £1,000)
Note: Priority will be given to individuals from FINOS Member financial institutions and regulated industries.
APPLY FOR SEAT HERE
(if the form does not show up below because of company blocking, please try this link)
