Continuous control testing
Each automated control’s test runs daily over its whole population and records its result against a published root.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC4.1 | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. |
| ISO27001 A.5.36 | Compliance with the information security policy, rules and standards is reviewed on a set schedule. |
| HIPAA 164.308(a)(8) | The entity evaluates on a set schedule how well its security policies and procedures meet the rule. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every day of the report period, for each automated control. |
| Assert | Each day has a Control.tested Event citing a root, a sequence range, counts and exceptions. |
Owner
Compliance Officer, Legal Team.
Example
Each night the one-way windows test reads every one-way Action from the day. It records a Control.tested Event with the published root, 1,412 Actions checked and zero exceptions.