Mattakushi432 Compliance Monitoring
Continuous Control Monitoring Framework
Monitoring Levels
| Level | What | How | Frequency |
|---|---|---|---|
| Automated | Technical controls (patch status, MFA enforcement, encryption) | SIEM, CSPM, vulnerability scanners | Real-time / daily |
| Semi-automated | Process controls (access reviews completed, training done) | GRC platform, HRIS integration | Weekly / monthly |
| Manual | Judgment controls (policy adherence, vendor assessments) | Sampling, walkthroughs | Quarterly / annually |
Control Monitoring Architecture
Data Sources → Monitoring Tools → GRC Platform → Dashboard → Alerts
─────────────────────────────────────────────────────────────────────
SIEM logs → Splunk/Sentinel → ServiceNow → KCI view → Slack/email
CSPM scans → Wiz/Prisma → GRC → Risk heat → PagerDuty
Vuln scanner → Tenable/Qualys → GRC → map → Jira tickets
HRIS data → Direct API → GRC → →
Compliance Dashboard Design
Dashboard Sections
1. Overall Compliance Posture
- Compliance score by framework (0-100%)
- Trend vs prior period (up/down with delta)
- Controls by status: Effective / Needs Attention / Failing / Not Tested
2. Control Performance
| Control domain | Total | Effective | At risk | Failing |
|---|---|---|---|---|
| Access control | 24 | 22 | 1 | 1 |
| Change management | 12 | 11 | 1 | 0 |
| Vulnerability mgmt | 8 | 6 | 2 | 0 |
| Incident response | 10 | 10 | 0 | 0 |
3. Exception Register Summary
- Open exceptions by age (< 30 days / 30-90 days / > 90 days)
- Exceptions by severity (Critical / High / Medium / Low)
- Overdue remediation items
4. Upcoming Compliance Activities
- Access reviews due
- Policy attestations due
- Audit windows approaching
- Certification renewals
5. Regulatory Deadlines
- Breach notification windows (if active incidents)
- Filing deadlines
- Audit submission dates
Exception Management Process
Exception Lifecycle
Identified → Documented → Risk Accepted → Monitored → Remediated/Expired
Exception Request Template
Exception ID: EXC-2024-047
Control: CC6.1 — MFA for all admin access
Exception: Legacy system X cannot support MFA due to vendor limitation
Business justification: Critical operational system; vendor roadmap: MFA in Q3
Risk level: High
Compensating controls:
- Network-level access restriction (IP whitelist)
- Session recording enabled
- Access limited to 2 named administrators
- Quarterly access review
Requested by: [Name], [Title]
Approved by: CISO
Valid until: [Date — max 12 months]
Review date: [Mid-point review date]
Exception Approval Authority
| Risk level | Approval required |
|---|---|
| Low | Control owner |
| Medium | Compliance team |
| High | CISO or equivalent |
| Critical | CISO + Legal + Executive sponsor |
Exception Reporting
- All open exceptions in monthly compliance report
- Critical exceptions flagged to board/audit committee quarterly
- Exceptions approaching expiry: 30-day advance notification to owner
Policy Attestation Workflow
Annual Attestation Process
- Q4 prior year: Review and update all policies
- January: Distribute attestation to all covered employees
- Rolling 30 days: Employees read and acknowledge each policy
- Day 30: Send reminder to non-completers
- Day 45: Escalate non-completers to managers
- Day 60: Final escalation to HR for disciplinary follow-up
- End of cycle: Report completion rates to leadership
Attestation Coverage
| Policy | Audience | Frequency |
|---|---|---|
| Information Security Policy | All employees | Annual |
| Acceptable Use Policy | All employees | Annual |
| Data Classification Policy | All employees | Annual |
| Privacy Policy (internal) | All employees | Annual |
| Code of Conduct | All employees | Annual |
| Conflicts of Interest | Leadership + finance | Annual |
| PCI DSS (if applicable) | In-scope employees | Annual |
Completion Targets
- Overall completion: ≥ 98% by 60-day deadline
- Manager-level and above: 100% required
- Non-completion = unacceptable for audit purposes; HR notified
Compliance Calendar Template
By Regulation
GDPR / Data Protection
| Month | Activity |
|---|---|
| January | Annual privacy notice review |
| March | DPA / controller-processor agreements review |
| June | Data subject request metrics review |
| September | DPIA review for new processing activities |
| November | Data breach register review |
SOC 2
| Timing | Activity |
|---|---|
| Ongoing | Evidence collection for audit period |
| Quarterly | Access reviews, VA scans |
| 60 days before audit | Gap assessment |
| 30 days before audit | Evidence packaging |
| Audit window | Auditor fieldwork support |
ISO 27001
| Timing | Activity |
|---|---|
| Annual | Internal audit |
| Annual | Risk assessment |
| Annual | Management review |
| Annual | Policy review and approval |
| Every 3 years | Certification audit (+ annual surveillance audits) |
Automated vs Manual Control Testing
| Control type | Automated testing approach | Manual testing approach |
|---|---|---|
| MFA enforcement | Query IdP — % accounts with MFA disabled | Sample access logs; verify manual bypass impossible |
| Patch currency | Pull patch scan results; flag > 30-day-old critical patches | Review sample of systems for patch evidence |
| Encryption at rest | CSPM scan for unencrypted storage | Review encryption configuration documentation |
| Access reviews | Track completion % from GRC platform | Verify sample of certifications have correct decisions |
| Incident response | Tabletop exercise results | Review incident log for response time vs SLA |
| Change management | Pull % of changes with approved tickets | Sample emergency changes for retroactive approval |
Key Risk Indicators vs Key Control Indicators
Key Risk Indicators (KRIs) — leading indicators of risk
| KRI | Threshold | Action |
|---|---|---|
| Open critical vulnerabilities > 30 days | > 5 | Escalate to CISO |
| Failed login attempts (anomalous spike) | > 3× baseline | Trigger investigation |
| Privilege escalation events unreviewed | > 0 | Immediate review |
| Employees without security training | > 5% | Escalate to HR |
| Critical vendor without SOC 2 | > 0 | Risk acceptance or remediation |
Key Control Indicators (KCIs) — lagging indicators of control effectiveness
| KCI | Target | Alert threshold |
|---|---|---|
| MFA adoption rate | 100% | < 98% |
| Access review completion | 100% by deadline | < 95% at 30 days |
| Patch SLA compliance (critical) | 100% within 30 days | < 90% |
| Policy attestation completion | ≥ 98% | < 90% |
| Incident response time (P1) | < 1 hour | > 4 hours |
Compliance Reporting
Monthly Report — Internal
- Control effectiveness summary (% effective)
- Open exceptions and aging
- Incidents with compliance implications
- Upcoming deadlines
Quarterly Report — Leadership
- Compliance posture vs prior quarter
- Key risks and mitigations
- Audit findings and remediation status
- Regulatory changes on horizon
Annual Report — Board / Audit Committee
- Year-in-review: assessments completed, certifications maintained
- Material risks and how addressed
- Budget vs actuals for compliance program
- Roadmap for coming year
Regulatory Change Management
- Monitor: Subscribe to regulatory update feeds (IAPP, regulatory agency newsletters)
- Assess: For each change, assess applicability and impact on current controls
- Gap analysis: Identify control gaps created by new requirements
- Remediation plan: Timeline and owner for each gap
- Update: Revise policies, procedures, training to reflect changes
- Communicate: Brief relevant teams and leadership on changes
- Document: Record assessment and response for audit evidence