Lesson 3.57: Continuous control monitoring
An annual audit tells you a control worked on the days that were sampled. Continuous control monitoring checks controls automatically every day, against an expected state, so drift (MFA switched off for an account, logging disabled on a server, a failed backup) is found in hours instead of at the next audit. In the lab you read the expected states, count today's failures per control, compare with yesterday to find what changed, check a temporary suppression and raise alerts only for new, unsuppressed drift.
16 min
You will learn to
- Explain continuous control monitoring and drift
- Express controls as expected states
- Count failures per control from automated checks
- Find new failures by comparing two days
- Handle suppressions with an expiry
Key terms
- Continuous control monitoring (CCM)
- Automated, frequent testing of controls against expected states.
- Expected state
- The machine-checkable value a control should have.
- Drift
- A system moving away from its expected state after it was compliant.
- Suppression
- A temporary, documented decision not to alert on a known failure.
- Delta
- What changed between two runs.
← Policy versus configuration · All lessons · Validating the metrics you report →