N100FN100F
Published on

Evidence that collects itself

Annual compliance portrays one day; continuous compliance portrays them all. Once most controls check themselves and store their result, the state of security stops being a surprise at every audit.

Service line Cybersecurity

The photograph and the film

An annual audit is a photograph: it says how everything stood on one particular day. What happens on the other 364 days does not show. A configuration that broke in March and was fixed in November, just before the audit, leaves no trace.

Continuous compliance is the film: controls check themselves, frequently, and every result is stored with its date.

From manual hunting to a dashboard

The photograph and the filmEvidence effort over a year, manual with peaks against automatic and constant, and 64 controls, 52 automatic.SECURITY · CONTINUOUS COMPLIANCEThe photograph and the filmJanFebMarAprMayJunJulAugSepOctNovDecauditauditautomatic: low and constantEffort spent gathering evidence64controls in the catalogue52check themselves12manual review with minutesThe state of security stops being a surprise:it is a fact, available at any moment.Illustrative data; they do not correspond to any real caseN100F · n100f.com

A continuous evidence system has three pieces:

  1. Automatic checks for every control that allows one: they read the real configuration of the clouds, the identity systems, the repositories and the deployment platform.
  2. An evidence store where every result is kept, dated and protected against modification.
  3. A dashboard showing the state of each control and each framework, alerting the owner when something stops being met.

What can be automated

Far more than it seems. Almost everything that lives in configuration can check itself: encryption, second factor, network exposure, logging switched on, tags, system versions, the results of each server's baselines and of the rules as code.

What requires human judgement (risk assessment, access review, rehearsals) is not automated, but its reminder, its record and its evidence are: the system raises an alert when it is due, stores the minutes and marks the control as met or overdue.

What changes

  • The audit stops being a project: the auditor reviews the evidence store.
  • Problems are visible when they appear, not months later.
  • The state of security is a fact, available at any moment to the board or to a customer.

With controls that demonstrate themselves, it is time to review the layers of protection that fail most in practice. The first is the oldest and the most broken: least privilege.

How we apply it: Cybersecurity.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk