---
title: "Continuous Monitoring: Definition and Compliance Guide"
description: "Learn how to implement continuous monitoring that satisfies ISO 27001, SOC 2, NIS2, and DORA requirements. Covers monitoring strategies, control effectiveness, automated evidence collection, and compliance reporting."
canonical: https://www.orbiqhq.com/glossary/continuous-monitoring
html: https://www.orbiqhq.com/glossary/continuous-monitoring
publisher: Orbiq GmbH
language: en
---
# Continuous Monitoring: Definition and Compliance Guide

Learn how to implement continuous monitoring that satisfies ISO 27001, SOC 2, NIS2, and DORA requirements. Covers monitoring strategies, control effectiveness, automated evidence collection, and compliance reporting.


## What Is Continuous Monitoring?

Continuous monitoring is the automated, ongoing assessment of an organisation's security controls, compliance status, and risk posture. It replaces periodic, point-in-time compliance checks with real-time visibility into whether controls are operating effectively, evidence is current, and regulatory requirements are being met.

For compliance-driven organisations, continuous monitoring is both a regulatory requirement and an operational efficiency tool. ISO 27001, SOC 2, NIS2, and DORA all require ongoing monitoring of control effectiveness, making it a core compliance capability.

## Continuous Monitoring Components

| Component | Description | Output |
| --- | --- | --- |
| **Control monitoring** | Track whether security controls are operating as designed | Control effectiveness dashboard |
| **Evidence collection** | Automatically gather and maintain compliance evidence | Current evidence repository |
| **Configuration monitoring** | Detect drift from security baselines | Configuration compliance reports |
| **Vulnerability monitoring** | Track vulnerability and patch status across all assets | Vulnerability posture dashboard |
| **Access monitoring** | Verify access controls, permissions, and MFA compliance | Access compliance reports |
| **Third-party monitoring** | Track vendor security posture and compliance status | Vendor risk dashboard |
| **Incident monitoring** | Track detection times, response times, and resolution | Incident metrics dashboard |

## Monitoring Frequencies

| Control Area | Monitoring Frequency | Rationale |
| --- | --- | --- |
| **Security events** | Real-time | Immediate threat detection and response |
| **Configuration compliance** | Hourly to daily | Detect drift before exploitation |
| **Vulnerability status** | Daily to weekly | Track patching progress against SLAs |
| **Access permissions** | Weekly to monthly | Detect privilege creep and orphaned accounts |
| **Policy compliance** | Monthly | Verify policy adherence across the organisation |
| **Third-party risk** | Monthly to quarterly | Track vendor security posture changes |
| **Control effectiveness** | Quarterly | Comprehensive control assessment |
| **Risk assessment** | Annually + trigger-based | Full risk reassessment with change-triggered updates |

## Automation Levels

| Level | Description | Examples |
| --- | --- | --- |
| **Fully automated** | No human intervention, continuous data collection | CSPM scanning, vulnerability scanning, log collection |
| **Semi-automated** | Automated collection with human review | Access reviews, policy exception approvals |
| **Manual with reminders** | Human-performed with automated scheduling | Risk assessments, vendor reviews, tabletop exercises |
| **Evidence-linked** | Manual activities with automated evidence tracking | Training completion, policy acknowledgements |

## Compliance Requirements

### Framework Mapping

| Requirement | ISO 27001 | SOC 2 | NIS2 | DORA |
| --- | --- | --- | --- | --- |
| Monitoring and measurement | Clause 9.1 | CC4.1 | Art. 21(2)(a) | Art. 13 |
| Control effectiveness | Clause 9.1 | CC4.1 | Art. 21(2)(g) | Art. 10(2) |
| Internal audit | Clause 9.2 | CC4.2 | Art. 21(2)(g) | Art. 13 |
| Management review | Clause 9.3 | CC4.2 | Art. 21(1) | Art. 13 |
| Corrective action | Clause 10.2 | CC4.2 | Art. 21(2)(g) | Art. 13 |

### Audit Evidence

| Evidence Type | Description | Framework |
| --- | --- | --- |
| Monitoring procedures | Documented monitoring strategy and frequencies | All frameworks |
| Monitoring dashboards | Real-time compliance status visibility | All frameworks |
| Control effectiveness reports | Evidence that controls operate as intended | All frameworks |
| Evidence freshness logs | Tracking of evidence collection dates and currency | All frameworks |
| Remediation records | Documentation of identified gaps and resolution | All frameworks |
| Management reports | Regular compliance reporting to leadership | All frameworks |
| Trend analysis | Historical compliance metrics showing improvement | ISO 27001, SOC 2 |

## Continuous Monitoring Metrics

| Metric | Target | Description |
| --- | --- | --- |
| **Control effectiveness rate** | > 95% | Percentage of controls operating as intended |
| **Evidence freshness** | > 90% current | Percentage of evidence updated within required timeframes |
| **Mean time to detect** | < 24 hours | Average time to identify control failures |
| **Mean time to remediate** | < 7 days | Average time to resolve compliance gaps |
| **Automation coverage** | > 70% | Percentage of controls with automated monitoring |
| **Compliance score** | > 90% | Overall compliance posture across all frameworks |

## Common Mistakes

| Mistake | Risk | Fix |
| --- | --- | --- |
| Treating compliance as annual project | Gaps accumulate between audits, scramble before assessments | Implement continuous monitoring with automated evidence |
| Monitoring without action | Detecting issues but not resolving them promptly | Define SLAs for remediation and track resolution |
| Over-reliance on manual checks | Human error, inconsistency, and scalability limits | Automate high-frequency and high-risk monitoring |
| No management visibility | Leadership unaware of compliance status until audit | Regular compliance dashboards and management reporting |
| Monitoring tools in silos | Fragmented view, duplicate effort, gaps between tools | Centralise monitoring in a GRC platform |
| No trending or historical analysis | Cannot demonstrate continuous improvement | Track metrics over time and report trends |

## How Orbiq Supports Continuous Monitoring

Orbiq is purpose-built for continuous compliance monitoring:

- **Automated evidence collection** — Connect tools and automatically gather compliance evidence
- **Real-time dashboards** — Track control effectiveness and compliance status continuously
- **Trust Center** — Share your compliance posture via your [Trust Center](/glossary/trust-center)
- **Multi-framework mapping** — Monitor controls across ISO 27001, SOC 2, NIS2, and DORA simultaneously
- **Audit readiness** — Maintain audit-ready status continuously rather than preparing before each audit

## Further Reading

- [Compliance Automation](/glossary/compliance-automation) — Governance, risk, and compliance automation
- [SIEM](/glossary/siem) — Security event monitoring and analysis
- [Cloud Security Posture Management](/glossary/cloud-security-posture-management) — Cloud configuration monitoring
- [Vulnerability Management](/glossary/vulnerability-management) — Continuous vulnerability tracking
- [Risk Management Frameworks](/glossary/risk-management-frameworks) — Risk monitoring and assessment