Compliance monitoring is a routine that checks, on a schedule you set, whether each security control still works and has current evidence, and shows the result beside the risk it leaves open. This guide suits a compliance lead or IT head at a firm in India or the GCC, and it names no tool. The guide has seven steps, each with a yes/no check; the order and the checks are Signisys’ own working method. It draws its six-step cycle and its way of choosing check frequency from NIST SP 800-137, US federal guidance from September 2011. NIST wrote it for federal information systems, and it covers information security monitoring, a narrower job than this routine. It is not a rule for you. The guide states no rule from any regulator. If you need one, ask the person who owns compliance at your firm what your regulator requires.
Last reviewed 2026-11-01 by Manish Sharma.
Compliance Monitoring in Short: Seven Steps and Seven Yes/No Checks
Here the seven steps run in a set order, and each ends in a check with only two possible answers, yes or no. The order is Signisys’ own, although NIST’s six steps cover similar ground. Also, a step without a recorded “yes” counts as not done.
| Step | Why it sits here | Yes/no check |
|---|---|---|
| Choose the controls worth watching | A short list is easier to keep up, and every later step runs against it. | Does each control name the risk it holds back? |
| Give each control an owner and a check | If a control has no owner, it can stop working unnoticed. | Can the owner show the answer from a record? |
| Set how often each check runs | If one schedule serves every control, it ignores how differently controls change. | Does each frequency have a reason written beside it? |
| Record evidence where it is made | If evidence is gathered later by hand, it records when it was written, not when the check ran. | Does each record show its date and source? |
| Rate each result in plain words | If a missed check looks like a passed one, a gap stays out of sight. | Is a missed check shown as Overdue? |
| Put status beside risk on one page | While status sits apart from risk, a failed check reads as paperwork. | Can a reader name one open risk from the page alone? |
| Close each finding and review the routine | A later check shows that the fix held. | Does each closed finding point to a later check that passed? |
Compliance Monitoring and NIST’s Six-Step Cycle: What It Covers and What It Does Not
NIST SP 800-137 (September 2011) lays out six steps for keeping a continuing view of security controls; the seven steps here cover the same ground, and the mapping in the table is Signisys’ own, not NIST’s.
NIST defines information security continuous monitoring (ISCM) as “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions”. That scope is narrower than compliance monitoring in this guide’s terms. NIST wrote it for US federal systems, but this guide uses the six steps as a method, not as a requirement.
| NIST’s step | Our steps |
|---|---|
| “Define an ISCM strategy” | Step 1, choose the controls |
| “Establish an ISCM program” | Steps 2 and 3, own the controls and set frequencies |
| “Implement an ISCM program” | Step 4, record evidence |
| “Analyze data and Report findings” | Steps 5 and 6, rate results and show status beside risk |
| “Respond to findings” | Step 7, close findings |
| “Review and Update the ISCM strategy and program” | Step 7, review the routine |
The mapping is Signisys’ own, not NIST’s. NIST also sets no interval for any control. NIST CSF 2.0 (CSWP 29), dated 26 February 2024, has a Continuous Monitoring category, DE.CM: “Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events”. That finds adverse events, but it is not a check that a control still works, and this guide keeps the two apart.
Compliance Monitoring, Steps 1 to 3: Choose, Own and Schedule
The routine starts with three decisions. Before any evidence is recorded, they decide what to watch, who watches it and how often.
Compliance Monitoring, Step 1: Choose the Controls Worth Watching
Start from the risks you already know and pick the controls that hold each one back. Watch a short list well instead of the full set thinly. This maps to the first of NIST’s steps, “Define an ISCM strategy”.
Take the risk register from your latest assessment as the input; this guide does not redo the assessment. For each of the top risks, name the one or two controls that matter. Mark which are technical, for example a setting or a log, and which are management controls, for example a review or an approval, because the check differs. This guide gives no control list.
Signisys puts this step first because every later step needs a list to run against.
Does each control on the list name the risk it holds back?
Step 2: Give Each Control an Owner and a Check
Name one person as owner of each control. Write one check for it as a question with a yes or no answer, such as “do the live settings match the approved baseline?”. The owner is the person who can see the control working, although that may not be the person who set it up.
Write the check so the owner can answer it from a record, not from memory. Evidence here means a dated record, made by a system or a person, that shows when the check ran and what it found. A clear policy also helps, since a check needs an expected state to compare against. To see how a policy line can sit with no setting or evidence behind it, read how a policy line ends up with no evidence behind it.
Signisys puts this step second because a frequency and a rating depend on a control having an owner and a question to answer.
Can the owner show the answer to the check from a record?
Compliance Monitoring, Step 3: Set How Often Each Check Runs
Choose a frequency for each control and write the reason beside it. NIST SP 800-137 (September 2011, US federal guidance) calls setting frequencies one of the “critical functions of the organization’s ISCM program” and lists criteria for choosing them. It sets no interval for any control, and neither does this guide.
- Volatility: “Volatile security controls are assessed more frequently”. How fast does this control change?
- Impact level: NIST’s example is systems “categorized as high-impact”. Ask how much a failure would hurt; a plain high, medium or low is Signisys’ own rating.
- Critical functions: “Security controls or assessment objects that provide critical security functions (e.g., log management server, firewalls) are candidates for more frequent monitoring.” Is this control one of them?
- Known weaknesses: controls documented as having weaknesses are “monitored more frequently until remediation of the weakness is complete”. Is a fix still open?
- Risk tolerance: NIST ties frequency to “a low tolerance for risk”. How little failure can the firm accept?
NIST’s list is longer, but this guide uses five. While the criteria are NIST’s, the order of steps is Signisys’ own: frequency follows the owner and the check.
Does each control’s frequency have a written reason beside it?
Key Takeaway Give every control its own frequency, and write down the reason beside it; this guide sets no interval.
Compliance Monitoring, Steps 4 to 7: Record, Rate, Show and Close
Compliance monitoring turns each check into a result a reader can act on in these four steps.
Step 4: Record Evidence Where It Is Made
Let each check leave its own dated record in the place where the work happens. Keep the record with the control’s row. This maps to NIST’s “Implement an ISCM program”, which says: “Automate collection, analysis, and reporting of data where possible.”
But manual controls still count. NIST SP 800-137 says “all implemented security controls, including management and operational controls, must be regularly assessed for effectiveness, even if the monitoring of such controls cannot be automated or is not easily automated.” The word “regularly” is NIST’s and gives no interval.
Each record shows its date and where it came from. This guide names no tool.
Signisys puts this step here because a rating in Step 5 is only as good as the record behind it.
Does each record show its date and source?
Compliance Monitoring, Step 5: Rate Each Result in Plain Words
Give every check one of three ratings, in words a director would use: Passing, Failing or Overdue. The ratings are Signisys’ own, and they map to NIST’s “Analyze data and Report findings”.
| Rating | Meaning | What happens next |
|---|---|---|
| Passing | The check ran on schedule, the answer was yes and the evidence is current. | If the rating stays Passing, the owner changes nothing. |
| Failing | When the check ran and the answer was no, a finding is opened. | When a finding is opened, it gets an owner and a due date. |
| Overdue | If the check missed its set frequency or its evidence is out of date, it stays Overdue. | The row keeps this rating until a check runs. |
Signisys puts this step here because a missed check needs its own rating, or it looks like a pass.
Does the page show a missed check as Overdue and not as Passing?
Step 6: Put Status Beside Risk on One Page
Show each control’s rating next to the risk it leaves open, on one page. A failed or overdue check reads as an open risk, not as a task. The page is for the compliance owner and the IT head. Any spreadsheet can hold it if it has the five columns below. To judge whether a sheet is still enough, try five tests to run on your own tracking sheet. For example, the two rows below show how compliance monitoring reads on this page, and both are illustrative.
| Control | Owner | Rating | Evidence date | Risk left open |
|---|---|---|---|---|
| Server settings match the approved baseline | Server team lead | Failing | Date of the latest settings report | An exposed server could be reached by an attacker. |
| Firewall logs reach the log server | Security analyst | Overdue | Date of the latest log check | An attack on the network could go unseen. |
NIST SP 800-137 warns in a footnote that dashboards and metrics “can provide a false sense of security if used without continued assurance of the relevance of the metrics”. Also, the page lists only controls that are still on the list from Step 1.
Can a reader name one open risk from the page alone?
Compliance Monitoring, Step 7: Close Findings and Review the Routine
Confirm each fix with a later check, and give each finding an owner and a due date. Also review the routine itself. This maps to NIST’s last two steps, “Respond to findings” and “Review and Update the ISCM strategy and program”.
NIST says: “Respond to findings with technical, management, and operational mitigating activities or acceptance, transference/sharing, or avoidance/rejection.” In plain words, which are ours: fix it, accept it with a named approver, or move it elsewhere.
For the routine, NIST SP 800-137 says a strategy includes “criteria describing the conditions that trigger a review or update of the strategy, in addition to the preestablished frequency audit”. Also write down your own conditions. For example, a control that fails twice and a control whose owner changes are two such conditions, both Signisys’ own.
Does each closed finding point to a later check that passed?
Key Takeaway Close each finding with a later check that passed, and review the routine when one of your written conditions applies.
A Worked Example of Compliance Monitoring: One Control Through the Seven Steps
This example is illustrative: it names no client, uses no numbers and sets no interval. The control is “server settings match the approved baseline”. It is a configuration control, and NIST SP 800-137 also lists configuration settings among its volatile controls. Compliance monitoring on this one control runs as follows.
The control is chosen because it holds back the risk of an exposed server.
The server team lead owns it, and the check asks: do the live settings match the approved baseline?
Frequency set higher, with the reason written down: NIST lists configuration settings among its volatile controls and the servers face the internet (no interval).
The settings report is saved with its date, as well as its source.
When the first report shows that some settings differ, the control is rated Failing.
The page also shows the Failing rating beside “an exposed server could be reached by an attacker”.
The finding gets an owner and a due date. Before it is closed, a later report is checked.
If the next report does not arrive, the row reads Overdue, which is the point of the rating.
What This Routine Does Not Cover, and Where to Go Next
This routine does not say what any regulator or standard requires; ask your compliance owner which checks your regulator requires. It also does not list the controls or choose a tool. Separate later articles cover the list of controls, the choice of a tool and the reasons gaps stay hidden. For the list of controls, read a 16-check test of controls, records and follow-up. It does not say when to redo the assessment, which is the job of when to redo the assessment itself.
The routine works without a zero trust programme. See how zero trust and governance fit together for the same idea at programme level. For the wider picture, see how a security compliance view gets built. The glossary entry on cybersecurity also covers the basic term.
A pass shows a control worked on the day of the check; it does not show the firm is compliant or safe. Get specialist help when a regulator’s exact rule applies.
Signisys helps organizations find, prioritize and reduce security risks, with clear visibility of security posture and compliance. The solution includes Reporting and Remediation Tracking: a clear view of risk, progress and evidence for audits. The exact scope is agreed for each engagement. We provide this through our VAPT and Cybersecurity Risk Assessment solution and our Cybersecurity Services page.
Compliance Monitoring FAQ
What is compliance monitoring for security controls?
How often should each control be checked?
Is compliance monitoring the same as security monitoring?
Do I need software to start?
How is this different from a risk assessment?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.