Quantifying Compliance-as-Code Maturity: A Reference Implementation and Controlled Evaluation of a Five-Stage Ladder over the NIST SP 800-53 Moderate Baseline

Abstract

Regulated cloud authorization is shifting from annual narrative System Security Plans to continuous, machine-readable evidence, driven by FedRAMP 20x, the EU's DORA, and DoD continuous authorization. OSCAL standardizes how such evidence is represented but does not indicate where an organization stands on the path to continuous validation. This paper introduces the Compliance-as-Code Maturity Ladder, a five-stage model (L0 Manual to L4 Self-Healing), and a five-layer Control-to-Evidence Traceability Matrix linking regulatory intent to signed evidence. Unlike prior maturity models, this one is instantiated as a working reference implementation and evaluated quantitatively. Run over the real NIST SP 800-53 Rev 5 Moderate baseline (287 controls), the pipeline achieves 100% reference resolution, sub-millisecond policy evaluation, 100% signature verification, and zero reconciliation error; these self-consistency results confirm correctness, not framework value. A separate controlled experiment shows ladder-guided remediation sequencing reduces time to authorization readiness by 24% (11.0 vs. 14.4 sprints) when cost and risk are independent, narrowing to 12% when they correlate. The system-under-assessment state is synthetic, a stated limitation, with AWS live-environment validation specified as next steps. All code, catalogs, and generators are documented with fixed seeds for reproduction.