For regulated teams that build in Azure DevOps
Compliance management, built into Azure DevOps.
Compliance4DevOps brings your standards, clauses, assessments, and audit evidence into the platform where your engineering work already lives.
30-day free trial · No credit card required
Two software requirements have no verifying test.
Modern Requirements is trusted by the world’s leading businesses
Microsoft Certified Solutions & AI Partner · SOC 2 and ISO 9001 certified
Your evidence is already in Azure DevOps. Your compliance record isn't.
The evidence lives in Azure DevOps. The record that maps it to the standard lives in spreadsheets and email. Compliance4DevOps puts both in one place.
Before
After
Standards, applicability, verdicts and findings, next to the engineering work.Audit package readyThe compliance record lives next to the engineering work. The evidence stays where your team created it.
Standards in. Audit packages out.
No separate tool to maintain. Standards, clauses, controls, and evidence are drawn straight from the work your teams already do in Azure DevOps.
EVIDENCE › CONTROL › CLAUSEAudit package
- Clause table with verdicts
- Evidence index
- Findings and corrective actions
-
Adopt a standard
Start from a standard in the library that Modern Requirements maintains, or load your licensed copy of a standard or your own policy. Each clause becomes a record your team can assess and link.
StandardsLibraryIn your organizationLoaded from your licensed copyIEC 62304:2006+A1:201534 clausesIn useISO 13485:201642 clausesIn useLibrary, maintained by Modern RequirementsNIST SP 800-53 Rev. 5Public standardAdoptNIST SP 800-171 Rev. 2Public standardAdoptHIPAA Security RulePublic standardAdopt -
Decide what applies
Record an applicability decision for each clause in the event. Anything marked not applicable carries a written justification, so the auditor can see why.
Applicability70 applicable · 6 not applicable5.2.6Verify software requirementsApplicable7.3.9Control of design and development changesApplicable7.3.7Design and development validationNot applicableJustification: Validation of this release is covered by a separate compliance event. Decided by Dana Whitfield, 8 Sep 2026. -
Map controls once
A clause says what the standard requires. A control is what your team does about it. Link one control to every clause it satisfies, in every standard you follow.
Control CTRL-012Owner: Priya RamanCode and configuration changes are reviewed and approved before merge.Linked to 4 clauses in 4 standardsISO 13485:2016 · 7.3.9Control of design and development changesIEC 62304 · 8.2Change controlNIST SP 800-171 Rev. 23.4.3SOC 2CC8.1EvidenceBranch policymain · Require approval from 2 reviewersPull request!412 Clamp bolus dose to configured limitCompleted -
Link evidence from Azure DevOps
Link the work items, test runs, pipeline runs and pull requests that show the work was done. Compliance4DevOps links to them where they are and does not copy them.
Link evidenceFrom Halo Insulin PumpWork item#2140 Feature: Bolus dose limit5.2.1, 5.2.6Test run4182 · System test · Passed5.2.6, 5.7Pipeline run20261014.3 · Succeeded5.7Pull request!412 · Completed8.2 -
Assess and close gaps
Give each clause a verdict. A gap becomes a finding with a severity, and each finding gets a corrective action with an owner and a due date.
Verdicts13 findings · 4 major · 9 minor5.1.1Software development planPass5.2.6Verify software requirementsPartial5.7Software system testingPass9Software problem resolutionFailF-007 · 5.2.6 MinorTwo software requirements have no verifying test.
CA-007Owner: Priya RamanDue: 13 Nov 2026 -
Generate the audit package
One action on the event produces the PDF your auditor reads, built from the template you choose.
Audit packageIEC 62304 and ISO 13485 internal audit 2026Template: Internal audit reportChangeGenerate audit packageGeneratedPDFAP-2026-014 Audit package.pdf18 pages · 20 Nov 2026 · Dana Whitfield
Works with the standards you answer to.
Adapts to the external standards and internal frameworks your team answers to.
Medical devices and pharma
Defense, aerospace and government
Automotive and manufacturing
Information security and privacy
Energy and infrastructure
Your own frameworks
Questions teams ask
How do I manage compliance in Azure DevOps?
Install Compliance4DevOps in Azure DevOps. Your team loads a standard, decides which clauses apply, links evidence from work items, test runs, pipeline runs and pull requests, assesses each clause, and generates the audit package, all inside Azure DevOps.
Can I replace my compliance spreadsheet with Azure DevOps?
Yes. The clause tracker, applicability decisions, verdicts, findings and corrective actions live in Compliance4DevOps inside Azure DevOps, linked to the evidence, instead of in a spreadsheet and a SharePoint folder.
How do I generate an audit package from Azure DevOps?
One action on a compliance event produces a PDF from a template. It contains a cover page, document control, a clause table with applicability and verdicts, an evidence index, and findings with corrective actions.
Which compliance standards does Compliance4DevOps support?
Teams use it for medical device standards such as ISO 13485, IEC 62304 and ISO 14971, defense and government frameworks such as CMMC and NIST SP 800-171, automotive standards such as ISO 26262 and ASPICE, security standards such as ISO 27001 and SOC 2, and their own internal policies and customer requirements.
Does our evidence leave Azure DevOps?
No. Compliance4DevOps runs inside Azure DevOps and links to your work items, test runs, pipeline runs and pull requests where they already are. It keeps the compliance record and does not copy the evidence.
Simplify your compliance work.
See your own clauses, verdicts and evidence links side by side in Azure DevOps, and walk into your next audit with the package already built.
30-day free trial · No credit card required
