Continuous Compliance vs Periodic Compliance

ARTICLE | Regulatory Compliance | Secure & Comply | Cross-industry / Regulated Industries

Periodic compliance proves a point in time. Continuous compliance proves a control kept operating between those points. Most regulated organizations need both, and most lean too heavily on the first.

The periodic cycle is familiar: assess, collect evidence, fix findings, certify, repeat. It works until a control breaks the week after the evidence was pulled. The audit file stays clean. The environment does not.

What each approach proves

What the standards already say

The periodic world already separates design from operation. A SOC 2 Type I report covers the design of controls at a date. A Type II report covers their operating effectiveness over a period. The distinction exists because a control that is designed well can still fail in operation.

ISO/IEC 27001 certification runs on a cycle, with surveillance audits between full certification audits. The standard itself requires ongoing monitoring and measurement, internal audit and management review. It does not treat the certificate as the assurance.

NIST SP 800-137 gives the clearest definition of continuous monitoring: maintaining ongoing awareness of information security, vulnerabilities and threats to support risk management decisions. NIST also notes that “continuous” means assessing controls and risks at a frequency sufficient to support risk-based decisions. That frequency is set by risk. It does not mean real time, and it is not a product category.

Drift is the real exposure

Consider a hypothetical. A regulated firm passes its privileged-access testing. Six weeks later, a platform migration moves a set of service accounts into a directory group that was never part of the quarterly review scope. The next scheduled test is months away. Nothing in the audit file is wrong. Something in the environment is.

Drift has a short list of usual causes:

• Configuration changes outside change control.

• Migrations and new systems that never enter the control scope.

• Staff and supplier changes that leave access and ownership behind.

• Exceptions that expire without anyone noticing.

• Tooling that quietly stops reporting, such as a logging agent removed from a subset of hosts or backups that run but cannot be restored.

A periodic assessment sees none of these unless it happens to land after them.

Which controls move first

Do not automate everything. Rank controls by how often they change, how much damage a failure causes, and whether a machine can test them. The first group gains most from continuous testing.

Many governance controls will never become continuous and should not be forced to. Their evidence is a decision, and a decision is made on a date.

How “continuous” goes wrong

• Evidence is not effectiveness. A tool can confirm MFA is enabled in the tenant policy while exceptions bypass it. Test the outcome, not only the setting.

• Failures turn into noise. Continuous tests produce exceptions. Without triage and an aging rule for open exceptions, the stream is ignored.

• The monitored estate is not the whole estate. Coverage depends on the asset inventory. If the inventory is wrong, every pass is partial.

• No data looks like no findings. The monitoring feed is itself a control. Track evidence freshness, the age of the last successful test, so a broken feed shows up as a failure.

• Assessor acceptance. Agree in advance which automated evidence your assessor will accept and how it is validated. Otherwise you run both processes in full.

A transition that does not break the audit

1. Select ten to fifteen Tier 1 controls that support current regulatory obligations.

2. For each, define the pass or fail test, the data source, the frequency, the owner and the time allowed to fix a failure.

3. Run the tests alongside the normal assessment for one full cycle. Note where the periodic result and the continuous result disagree. Those differences are your drift.

4. Agree the evidence with your assessor.

5. Reduce periodic sampling only for controls where the continuous test has proved reliable.

Measures that matter

• Evidence freshness: age of the last successful test per control.

• Time from control failure to detection.

• Exceptions open past their allowed time.

• Share of in-scope controls under continuous test, and the share of those with a failing result.

Where to start

List the regulatory obligations that depend on a control able to stop working without anyone noticing. Those controls are the first candidates for continuous testing, and the list is usually shorter than expected.

Sources

1. Information security continuous monitoring (ISCM), glossary entry citing NIST SP 800-137 — NIST Computer Security Resource Center

2. System and Organization Controls: SOC Suite of Services — AICPA & CIMA

3. ISO/IEC 27001, Information security management systems — ISO