What is the best compliance as code practices for modern

Technologies and Tools Enabling Compliance as Code

Top 5 Open-Source and Proprietary Tools/Frameworks for Compliance as Code

• Open Policy Agent (OPA)

  A CNCF-hosted, open-source policy engine that enables unified policy enforcement across cloud, Kubernetes, and legacy systems. OPA uses the Rego declarative language to define policies, making it highly extensible for custom compliance rules.

  Key features include:
  
• Cross-platform compatibility (AWS, Azure, GCP, Kubernetes, and on-premises).
• Policy-as-code with version control integration (Git).
• Real-time evaluation of infrastructure changes via REST APIs or sidecar proxies.
• Integration with Terraform, Pulumi, and Ansible via provider plugins.
• Chef Inspec

  A compliance testing framework by Chef that automates security and compliance validation using Infrastructure as Code (IaC) principles. Inspec leverages Ruby-based controls to test configurations against predefined benchmarks (e.g., CIS, NIST, PCI-DSS).

  Key features include:
  
• Pre-built compliance profiles for major standards (e.g., AWS CIS, Kubernetes CIS).
• Integration with CI/CD pipelines for shift-left compliance testing.
• Support for hybrid cloud and containerized environments.
• Ability to generate audit reports in formats like JSON, HTML, and JUnit.
• AWS Config

  A fully managed AWS service that continuously monitors resource configurations and compliance against predefined rules. AWS Config integrates with AWS Organizations for multi-account governance and provides remediation actions via AWS Systems Manager.

  Key features include:
  
• Over 200 managed rules covering AWS Well-Architected Framework and regulatory standards.
• Config rules written in AWS Lambda or custom logic.
• Compliance dashboards with historical trend analysis.
• Integration with AWS CloudTrail for change tracking.
• Azure Policy

  Microsoft’s native compliance-as-code solution for Azure environments, enabling enforcement of organizational standards across subscriptions and resource groups. Azure Policy supports both built-in and custom policies written in JSON or Natively (a domain-specific language).

  Key features include:
  
• Integration with Azure Blueprints for governance at scale.
• Real-time compliance evaluation with remediation workflows.
• Support for tag-based policy assignment and exclusion.
• Compliance reporting via Azure Monitor and Power BI.
• Tfsec

  An open-source static analysis tool for Terraform configurations, designed to detect compliance violations early in the development cycle. Tfsec scans Terraform files against a database of security and compliance policies (e.g., AWS, Azure, GCP, Kubernetes).

  Key features include:
  
• Lightweight CLI tool with GitHub Actions integration.
• Customizable policy rules with severity levels (critical, high, medium, low).
• Support for Terraform modules and remote state.
• Output in SARIF, JSON, and JUnit formats for CI/CD pipelines.

Infrastructure as Code (IaC) Platforms and Compliance Enforcement

Example Workflow:
1. A Terraform configuration defines an EC2 instance with encryption disabled.
2. Tfsec or OPA scans the plan and flags the violation during `terraform plan`.
3. The pipeline fails, and the developer corrects the configuration before approval.

Essential Features to Evaluate When Selecting a Compliance as Code Tool

• Policy Language Flexibility

  The ability to define custom policies using domain-specific languages (e.g., Rego for OPA, JSON for Azure Policy) or general-purpose scripting (e.g., Python for Inspec). Flexibility ensures alignment with niche compliance standards or proprietary controls.

  Considerations:
  
• Support for declarative vs. imperative policy definitions.
• Ease of extending built-in rules (e.g., adding custom CIS benchmarks).
• Versioning and backward compatibility of policy languages.
• Real-Time Scanning and Drift Detection

  Continuous monitoring of infrastructure state to detect deviations from compliant configurations. Tools like AWS Config or Azure Policy provide real-time alerts, while IaC integrations (e.g., Terraform Cloud) offer pre-deployment validation.

  Considerations:
  
• Frequency of compliance checks (e.g., per-minute vs. hourly).
• Support for hybrid environments (cloud + on-premises).
• Automated remediation capabilities (e.g., auto-correcting misconfigurations).
• Integration Capabilities

  Seamless connectivity with CI/CD pipelines, cloud providers, configuration management tools, and monitoring systems. APIs, plugins, and native integrations (e.g., OPA’s REST API, Inspec’s Ansible roles) are essential for embedding compliance into existing workflows.

  Considerations:
  
• Supported IaC platforms (Terraform, Pulumi, Ansible, CloudFormation).
• Compatibility with ticketing systems (e.g., Jira, ServiceNow) for compliance violations.
• Native cloud provider integrations (e.g., AWS Config for AWS, Azure Policy for Azure).
• Compliance Benchmark Support

  Pre-built compliance profiles for industry standards (e.g., ISO 27001, SOC 2, HIPAA, GDPR) reduce the effort required to define policies from scratch. Tools like Inspec or Tfsec include curated benchmarks for common frameworks.

  Considerations:
  
• Availability of up-to-date benchmarks (e.g., CIS Amazon Linux 2, Kubernetes CIS).
• Customization options for benchmark rules.
• Audit trail generation for compliance reporting.
• Scalability and Performance

  Tools must handle large-scale environments (e.g., multi-cloud, multi-region) without degrading performance. Scalability is critical for enterprises with thousands of resources or frequent policy updates.

  Considerations:
  
• Support for distributed policy evaluation (e.g., OPA’s sidecar model).
• Performance benchmarks for policy evaluation speed.
• Resource usage (CPU, memory) during scans.
• Reporting and Auditability

  Generating compliance reports in standardized formats (e.g., CSV, PDF, JSON) is essential for audits and regulatory submissions. Tools should provide granular logs of policy evaluations, changes, and remediation actions.
  

  Use Cases Across Industries and Compliance Domains

  Compliance as Code transforms static, manual compliance processes into automated, scalable workflows, enabling organizations to enforce policies dynamically across complex environments. Its adoption spans industries where regulatory adherence is critical—such as healthcare, finance, and cloud-native operations—while addressing domain-specific challenges like cross-border data privacy, financial audits, and infrastructure security. Real-world implementations demonstrate measurable improvements in audit efficiency, risk reduction, and operational agility, particularly in multi-cloud and hybrid architectures.

  The following sections explore industry-specific applications, a comparative analysis of compliance domains, implementation procedures for multi-cloud environments, and case studies illustrating tangible benefits achieved through Compliance as Code adoption.
  

  Industry-Specific Applications of Compliance as Code

  Compliance as Code is deployed across sectors where regulatory frameworks impose stringent requirements, often with high stakes for non-compliance. Three prominent use cases—healthcare (HIPAA), financial services (SOX/GDPR), and cloud security (CIS benchmarks)—demonstrate how automation aligns technical controls with regulatory mandates while reducing human error.

  Healthcare: Automating HIPAA Compliance in Patient Data Systems
  Healthcare organizations must comply with the Health Insurance Portability and Accountability Act (HIPAA), which mandates safeguards for protected health information (PHI). Compliance as Code automates:
  

  Access controls: Enforcing role-based access (e.g., via Open Policy Agent (OPA)) to PHI databases, ensuring only authorized personnel (e.g., doctors, billing staff) can access patient records.

  Data encryption: Deploying AWS KMS or Azure Key Vault policies to encrypt PHI at rest and in transit, with automated key rotation aligned to HIPAA’s cryptographic standards.

  Audit trails: Integrating SIEM tools (Splunk, Datadog) with compliance-as-code frameworks (e.g., Terraform + Checkov) to log and alert on unauthorized access attempts, fulfilling HIPAA’s accountability requirements.

  Example: A large hospital chain reduced HIPAA audit failures by 40% within 12 months by replacing manual access reviews with OPA policies that dynamically revoked permissions for terminated employees, while Terraform ensured consistent encryption configurations across 50+ regional data centers.

  Financial Services: SOX and GDPR Compliance in Cloud-Native Banking
  Financial institutions face Sarbanes-Oxley (SOX) for internal controls and GDPR for cross-border data flows. Compliance as Code enables:
  

  SOX controls automation: Using Open Policy Agent (OPA) to validate segregation of duties (SoD) in cloud-based financial workflows, such as restricting a single employee from approving and executing transactions.

  GDPR data residency: Enforcing AWS Config rules to ensure customer data stored in EU regions remains within GDPR’s territorial scope, with automated alerts for accidental data transfers to non-compliant regions.

  Third-party risk management: Scanning cloud deployments with Prisma Cloud or Tfsec to detect non-compliant dependencies (e.g., outdated libraries violating SOX’s IT general controls).

  Example: A European bank reduced SOX audit remediation time by 60% by integrating Terraform + OPA to auto-remediate misconfigurations in Azure Kubernetes Service (AKS), while GDPR data residency checks in AWS Config prevented a $2M potential fine for a data breach in the U.S.

  Cloud Security: Enforcing CIS Benchmarks Across Multi-Cloud Environments
  The Center for Internet Security (CIS) benchmarks provide prescriptive guidelines for securing cloud workloads. Compliance as Code automates:
  

  Benchmark enforcement: Deploying AWS Config, Azure Policy, and Google Cloud Security Command Center to continuously audit resources against CIS Level 1/2 benchmarks (e.g., disabling public S3 buckets, enforcing MFA for IAM users).

  Drift detection: Using Terraform + Infracost to identify deviations from baseline configurations (e.g., a new EC2 instance launched without a security group), triggering automated remediation via AWS Lambda or Azure Logic Apps.

  Compliance reporting: Generating NIST SP 800-53 or ISO 27001-aligned reports via Open Policy Agent (OPA) or SCAP (Security Content Automation Protocol) tools like OpenSCAP.

  Example: A global SaaS provider achieved CIS Level 2 compliance across AWS, Azure, and GCP by using Terraform modules to standardize security groups, IAM policies, and logging configurations, reducing manual audits from 100 hours/month to 5 hours/month.
  

  Comparative Analysis of Compliance Domains and Compliance as Code Solutions

  Compliance requirements vary by domain—each presenting unique challenges in automation, scalability, and cross-cutting controls. The following table contrasts security, privacy, and regulatory compliance domains, highlighting how Compliance as Code addresses their specific needs.
  

  Compliance Domain	Key Challenges	Compliance as Code Solutions	Technologies/Tools
  Security Compliance	Dynamic workloads (e.g., containers, serverless) require real-time policy enforcement.	Automated configuration drift detection and remediation using infrastructure-as-code (IaC) templates.	AWS Config, Azure Policy, Open Policy Agent (OPA), Prisma Cloud
  	Cross-platform vulnerabilities (e.g., misconfigured Kubernetes clusters).	Policy-as-code frameworks to enforce CIS benchmarks or custom security baselines across AWS EKS, Azure AKS, and GKE.	Terraform + Tfsec, Kyverno, Aqua Security
  	Third-party risk (e.g., supply chain attacks via cloud dependencies).	Automated scanning of IaC templates and container images for compliance with security SLAs (e.g., NIST SP 800-160).	Trivy, Snyk, Checkov, Anchore
  Privacy Compliance	Cross-border data flows require granular access controls and residency enforcement.	Policy-as-code to dynamically classify data (e.g., PII, GDPR "special categories") and enforce geo-fencing rules.	Open Policy Agent (OPA), AWS Macie, Microsoft Purview
  	Consent management and data subject rights (e.g., GDPR "right to erasure").	Automated workflows triggered by user requests (e.g., via API calls) to delete or anonymize data across databases and cloud storage.	Terraform + AWS Step Functions, Apache Atlas, Collibra
  	Vendor lock-in risks in multi-cloud privacy controls.	Portable policy definitions (e.g., Common Policy Language) to ensure consistent privacy rules across AWS, Azure, and GCP.	Open Policy Agent (OPA), Styra DAS, Google Cloud Policy Analyzer
  Regulatory Compliance	Static audit trails required for SOX, PCI DSS, or HIPAA.	Immutable logging and tamper-proof audit trails via blockchain or cryptographic hashing integrated into IaC pipelines.	AWS CloudTrail Lake, Azure Monitor, Hyperledger Fabric
  	Jurisdictional fragmentation (e.g., CCPA vs. GDPR).	Modular compliance-as-code modules to activate region-specific controls (e.g., CCPA’s "Do Not Sell" flags in Azure AD).	Terraform workspaces, Pulumi, Compliance-as-Code frameworks (e.g., Compliance-as-Code by Red Hat)
  	Manual documentation burdens for auditors.	Automated generation of compliance reports (e.g., NIST CSF, ISO 27001) from IaC state files and policy enforcement logs.	OpenSCAP, Aqua Security, Challenges and Mitigation Strategies in Compliance as Code Implementation Compliance as Code (CaC) transforms static regulatory requirements into dynamic, automated policies, but its adoption introduces operational and technical challenges. Organizations must navigate pitfalls such as policy drift, tool fragmentation, and the tension between automation and human judgment to ensure scalability and accuracy. This section examines five critical challenges, evaluates trade-offs in policy development, outlines a prioritization framework for high-velocity environments, and defines the optimal balance between automation and oversight. Five Common Pitfalls and Mitigation Strategies Implementing Compliance as Code without addressing foundational challenges risks inefficiencies, false compliance claims, or regulatory gaps. Below are five recurring pitfalls and actionable mitigation strategies, grounded in industry best practices and real-world deployments. Policy Drift Over time, automated policies may diverge from regulatory updates or organizational changes, leading to non-compliance. For example, a GDPR policy written in Open Policy Agent (OPA) may fail to account for new data subject rights amendments if not periodically synchronized with the latest EU regulations. Mitigation: Establish a policy versioning and reconciliation process using tools like Chef InSpec or Open Policy Agent (OPA) with built-in version control integration. Schedule quarterly audits to compare policy logic against updated frameworks (e.g., NIST SP 800-53 Rev. 5) and regulatory digests (e.g., IAPP’s GDPR tracker). Automate drift detection by integrating compliance scanners with CI/CD pipelines to flag discrepancies during deployment. False Positives and Noise in Alerts Overly permissive or rigid policy rules generate excessive alerts, desensitizing teams to critical violations. A 2023 Gartner report noted that 68% of organizations using CaC tools cited alert fatigue as a primary barrier to adoption. Mitigation: Implement a tiered alerting system with severity thresholds (e.g., critical/major/minor) and suppress non-actionable warnings via context-aware filtering. Use machine learning models (e.g., AWS GuardDuty or Microsoft Defender for Cloud) to analyze historical alert patterns and adjust sensitivity dynamically. Assign compliance engineers to review and recalibrate rules quarterly based on incident data. Tool Fragmentation and Siloed Compliance Adopting multiple CaC tools (e.g., Terraform Sentinel, Prisma Cloud, Dynatrace) without integration creates operational overhead and visibility gaps. A 2022 Forrester study found that 72% of enterprises using three or more CaC tools reported difficulties correlating findings across platforms. Mitigation: Standardize on a unified compliance platform (e.g., ServiceNow GRC, Splunk Security Cloud) with native integrations for policy engines like OPA or Kyverno. Use APIs to consolidate findings into a single dashboard (e.g., Grafana or Elasticsearch) and enforce a "single source of truth" policy repository. For hybrid environments, adopt OpenTelemetry for cross-tool event correlation. Lack of Traceability and Auditability Automated compliance checks may lack sufficient metadata to explain why a policy was enforced or how it was modified, complicating audits. The EU’s eIDAS Regulation mandates immutable logs for regulatory actions, yet many CaC implementations fail to meet this requirement. Mitigation: Enforce immutable audit trails by integrating policy engines with blockchain-based logging (e.g., Hyperledger Fabric) or SIEM tools (e.g., Splunk, Datadog) that capture: Policy execution timestamps and user contexts. Input/output data transformations (e.g., PII redaction events). Automated remediation actions (e.g., access revocations). Store logs in WORM (Write Once, Read Many) storage (e.g., AWS S3 Glacier) to prevent tampering. Over-Reliance on Static Policy Rules Hardcoded policies fail to adapt to dynamic environments (e.g., cloud auto-scaling, microservices). A 2023 Cloud Security Alliance (CSA) report highlighted that 45% of CaC failures stemmed from static rules misaligned with runtime conditions. Mitigation: Adopt adaptive policy frameworks that combine: Runtime enforcement: Use eBPF or Kubernetes Admission Controllers to evaluate policies during container orchestration. Contextual awareness: Integrate with SIEM/SOAR (e.g., Palo Alto XSOAR) to adjust rules based on real-time threat intelligence (e.g., blocking IAM changes during a DDoS attack). Policy-as-Code versioning: Treat policies as infrastructure (e.g., store in GitLab or Bitbucket) with branching for A/B testing in non-production environments. Trade-offs Between Custom Policy Development and Pre-Built Frameworks Organizations face a critical choice: develop bespoke compliance policies tailored to unique workflows or leverage standardized frameworks (e.g., NIST, ISO 27001, CIS Benchmarks). Each approach presents distinct trade-offs in accuracy, maintainability, and regulatory alignment. Criteria Custom Policy Development Pre-Built Frameworks (e.g., NIST, ISO 27001) Accuracy and Precision Higher alignment with organizational processes but risks gaps in emerging regulations (e.g., AI Act, DMA). Requires deep domain expertise (e.g., legal + DevOps collaboration). Example: A fintech startup may need custom rules for SEC 17a-4(f) record retention that pre-built frameworks do not address. Proven compliance with global standards but may over- or under-constrain specific use cases. Frameworks like ISO 27001 cover 114 controls but lack granularity for cloud-native environments. Example: CIS AWS Foundations Benchmark ensures baseline security but may conflict with a company’s zero-trust architecture. Maintenance Effort High ongoing cost due to manual updates, testing, and regulatory change tracking. Requires dedicated compliance engineers (estimated $150K–$300K/year per specialist). Mitigation: Use policy composition tools (e.g., OPA’s Rego language) to modularize rules and reduce duplication. Lower maintenance for static frameworks but may require customization for dynamic environments. Updates (e.g., NIST SP 800-53 revisions) often require rework. Example: NIST CSF 2.0 introduced risk management functions that necessitated policy overhauls for existing CaC implementations. Regulatory Alignment Risk of non-compliance if custom rules lag behind legislative changes (e.g., GDPR’s Article 30 records-of-processing updates). Solution: Integrate with regulatory change APIs (e Integration with DevSecOps and Continuous Compliance Compliance as Code (CaC) transforms traditional compliance from a periodic audit exercise into an automated, embedded process within modern software development workflows. By integrating with DevSecOps pipelines, CaC ensures compliance checks are executed in real-time, reducing manual effort, human error, and the risk of non-compliance during deployment. This alignment with DevSecOps—where security and compliance are "shifted left" into development—enables organizations to enforce policies dynamically, from code commit to runtime, while maintaining auditability and traceability. The synergy between Compliance as Code and DevSecOps hinges on embedding compliance gates into the CI/CD pipeline, leveraging static and dynamic analysis tools, and enforcing policy compliance at every stage of the software lifecycle. This approach minimizes compliance drift, accelerates remediation, and ensures that security and compliance are inherent to the development process rather than afterthoughts. Alignment of Compliance as Code with DevSecOps Stages Compliance as Code integrates seamlessly with DevSecOps by addressing security and compliance requirements at each phase of the software delivery pipeline. The following stages illustrate key integration points: Code Commit (Pre-Commit Hooks) Compliance policies are enforced before code is committed to the repository. Tools like pre-commit or Git hooks scan for violations (e.g., hardcoded secrets, outdated dependencies, or non-compliant configurations) using CaC frameworks like Open Policy Agent (OPA) or Chef InSpec. Violations trigger automated feedback or block commits entirely. Build Stage (Static Analysis - SAST/DAST) Static Application Security Testing (SAST) tools (e.g., SonarQube, Checkmarx) and Dynamic Analysis (DAST) tools (e.g., OWASP ZAP) integrate with CaC to evaluate source code and build artifacts against compliance policies. For example, a policy might mandate that all dependencies adhere to the CVE-2023 threshold or that no sensitive data is logged. Failures halt the build until remediation. Containerization (Image Scanning) Container images are scanned for vulnerabilities and compliance violations using tools like Trivy, Clair, or Aqua Security. CaC policies define allow-listed base images, prohibited packages, or runtime restrictions (e.g., no root containers). Non-compliant images trigger automated rebuilds or block deployment to staging/production. Infrastructure as Code (IaC) Validation Tools like Terraform, AWS CloudFormation, or Pulumi integrate with CaC to validate infrastructure definitions against compliance standards (e.g., CIS benchmarks, GDPR requirements). OPA’s rego language or tools like tfsec enforce policies such as "no public S3 buckets" or "encrypted EBS volumes by default." Deployment (Runtime Enforcement) Runtime security tools (e.g., Aqua, Sysdig, or Open Policy Agent’s conftest) monitor deployed environments for compliance drift. CaC policies define runtime constraints (e.g., "no SSH access to production databases") and trigger alerts or automated remediation (e.g., revoking non-compliant credentials). Post-Deployment (Continuous Auditing) Continuous compliance platforms (e.g., Prisma Cloud, Bridgecrew) perform ongoing audits of deployed resources, comparing them against CaC policies. Findings are logged in compliance management systems (e.g., ServiceNow, RSA Archer) for tracking and remediation. Sequence Diagram: Compliance Checks from Commit to Deployment The following text-based sequence diagram illustrates the end-to-end flow of compliance checks in a DevSecOps pipeline, including feedback loops for remediation: Actor: Developer Developer → [Git Hook] → [Pre-Commit Policy Check (OPA/InSpec)] [If Violation] → Developer (Feedback) → [Fix Code] [If Compliant] → [Commit to Repository] Developer → [CI Pipeline Trigger] → [Build Stage] [Build] → [SAST Scan (SonarQube)] → [Compliance Policy Check] [If Violation] → [Block Build] → Developer (Feedback) → [Fix Code] [If Compliant] → [Proceed to Container Build] [Container Build] → [Image Scan (Trivy/Clair)] → [Compliance Policy Check] [If Violation] → [Block Deployment] → [Rebuild Image] [If Compliant] → [Push to Registry] [IaC Validation (Terraform/Tfsec)] → [Compliance Policy Check] [If Violation] → [Block Deployment] → [Fix IaC] [If Compliant] → [Deploy to Staging] [Staging Deployment] → [Runtime Policy Check (Aqua/Sysdig)] [If Violation] → [Alert Team] → [Remediate] [If Compliant] → [Promote to Production] [Production Deployment] → [Continuous Auditing (Prisma Cloud)] [Findings] → [Compliance Dashboard] → [Automated Remediation] Key Feedback Loops: Developer Feedback: Immediate remediation guidance for code/commit violations. Build Blocking: SAST/DAST failures halt builds until compliance is achieved. Deployment Gating: Non-compliant containers or IaC configurations block deployments. Runtime Alerts: Drift detection triggers alerts or automated corrective actions (e.g., revoking permissions). Batch Compliance Scanning vs. Continuous Compliance The choice between batch compliance scanning (e.g., monthly audits) and continuous compliance depends on organizational risk tolerance, regulatory requirements, and operational agility. The following table compares the two approaches: Criteria Batch Compliance Scanning Continuous Compliance Frequency Periodic (e.g., monthly, quarterly). Real-time or near-real-time (per commit/deployment). Detection Latency High (violations may persist for weeks). Low (violations detected and remediated immediately). Automation Level Low (manual reviews, spreadsheets, or scripted checks). High (fully automated, integrated into CI/CD). Cost Lower upfront (tools like Nessus, Qualys). Higher upfront (requires DevSecOps toolchain). Regulatory Fit May suffice for low-risk environments (e.g., internal apps). Required for high-risk or regulated industries (e.g., PCI DSS, HIPAA, GDPR). Remediation Speed Slow (backlog of findings accumulates). Fast (immediate feedback loops reduce technical debt). Use Cases Legacy systems with infrequent changes. Organizations with limited DevSecOps maturity. Compliance requirements allowing periodic audits. Cloud-native applications with frequent deployments. Regulated industries (finance, healthcare, government). Organizations adopting DevSecOps or GitOps. Tooling Examples Nessus, OpenSCAP, manual audits. Open Policy Agent, Prisma Cloud, Aqua Security, Bridgecrew. Risk of Non-Compliance Higher (undetected violations may exist for extended periods). Lower (continuous monitoring reduces exposure). Best Implementing Compliance as Code is not merely about adopting tools but about reshaping organizational culture to prioritize security and governance from the earliest stages of development. By integrating compliance gates into CI/CD pipelines, organizations can block non-compliant deployments before they reach production, while continuous validation ensures ongoing adherence to evolving regulations. The future of compliance lies in its ability to scale with agility, reducing audit failures and operational friction. For enterprises navigating complex regulatory landscapes, this paradigm offers a path to efficiency, risk mitigation, and sustained trust in an increasingly digital world.

  • compliance as code
  • devsecops
  • infrastructure as code
  • policy enforcement
  • regulatory automation

  Leave a Comment

  Name

  Comment

  Post Comment

  Comments are moderated before appearing. The data you submit is processed according to the Privacy Policy of ir.msu.ac.zw.