Introducing Continuous Control Monitoring
Compliance has a timing problem. Controls are tested once a year, but they fail on random Tuesdays. An offboarded contractor keeps an active account for six weeks. A storage bucket goes public during a migration. MFA gets disabled “temporarily” and stays that way. In an annual-audit world, you find out months later — usually from your auditor, occasionally from an incident.
Today we’re closing that gap. Continuous Control Monitoring is now live in ComplianceDL, turning your control set from a static checklist into a living system that tests itself around the clock.
What’s new
Automated control checks, on a schedule you set
Connect your cloud provider, identity platform, code repositories, and key SaaS tools, and ComplianceDL runs automated checks against each mapped control — hourly by default, configurable per control. Over 200 checks ship at launch, covering the controls that anchor SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS programs:
- Access management: MFA enforcement, inactive accounts, privileged role membership, timely offboarding
- Infrastructure: encryption at rest and in transit, public exposure of storage and databases, network configuration
- Change management: branch protection, required reviews, production deployment approvals
- Availability and resilience: backup job success, retention settings, monitoring coverage
Each check is mapped to the frameworks it satisfies, so one passing check produces evidence for every framework in scope — no duplicate collection, no parallel spreadsheets.
Real-time drift alerts
When a control drifts out of compliance, the right person knows immediately. Alerts route through email, Slack-compatible webhooks, or your ticketing integration, with severity levels you define. Every alert includes the failing resource, the affected controls and frameworks, and a remediation summary — so the fix starts with context, not an investigation.
Alerts also respect ownership. Because every control in ComplianceDL has an assigned owner, notifications go to the person accountable, not to a shared inbox where they age quietly.
Evidence that collects itself
Every check run is recorded as timestamped, immutable evidence: what was tested, what was found, and against which control. When your audit window closes, your evidence isn’t a folder of screenshots assembled in a panicked week — it’s a continuous record showing each control operating throughout the period. For SOC 2 Type II observation periods and ISO 27001 surveillance audits, this is the difference between proving a point in time and proving a track record.
Auditor exports bundle check history, exceptions, and remediation timelines into a structured package, organized by framework and criteria.
The compliance health dashboard
A new dashboard gives you a live posture score across every framework in scope, trending over time. Drill from a framework down to a criterion, a control, and the individual resources behind it. When leadership asks “are we ready for the audit?”, the answer is now a number on a screen instead of a meeting.
Why we built it
Our customers told us the same story in different words: the audit was never the hard part — the eleven months between audits were. Point-in-time compliance rewards good snapshots, not good operations. Continuous Control Monitoring inverts that: your program’s default state becomes verified, and exceptions become visible the day they occur.
One early-access customer, a 140-person healthcare analytics company, caught a disabled backup job within hours of a routine infrastructure change — a failure that previously would have surfaced during their next HIPAA risk assessment, months later. That’s the shift we’re after: from discovering failures to preventing findings.
Getting started
Continuous Control Monitoring is available today on all ComplianceDL plans. Starter plans include core checks for cloud and identity integrations; Growth and Enterprise plans add the full check library, custom check scheduling, webhook alerting, and unlimited integrations.
Existing customers will see the new Monitoring tab in their workspace now — connect an integration and your first checks run within the hour. New to ComplianceDL? Visit /platform to see how it fits into your compliance program, or /plans to find the right tier.
Your controls don’t take eleven months off. Now your monitoring doesn’t either.