Annual compliance measures one day a year. The other 364 are the ones an incident happens on.
Continuous compliance monitoring tests control state on a schedule rather than at audit time, so drift is visible when it happens instead of eleven months later. In Microsoft Purview Compliance Manager, improvement action statuses refresh every 24 hours and automatic testing is on by default for every eligible action.
- Every 24 hoursImprovement action status refresh
- On by defaultAutomatic testing for eligible actions
- 360+Regulatory templates available
- Four sourcesAutomation signal types
Eight components, and the fourth is where most implementations stop early.
Automated testing of technical control state
Compliance Manager automatically identifies settings in the Microsoft 365 and multicloud environment that determine whether an improvement action implementation requirement is met. Automatic testing is on by default for all eligible improvement actions, and statuses refresh every 24 hours. That cadence is what makes drift visible in days rather than at the next audit.
Four signal sources feeding the picture
Built-in automation receiving signals from other Purview solutions including Data Lifecycle Management, Information Protection, Data Loss Prevention, Communication Compliance and Insider Risk Management. Microsoft Secure Score automation. Defender for Cloud automation across Azure, AWS and GCP. Plus connectors, with Salesforce and Zoom available now.
A score that reflects risk rather than count
Compliance Manager awards points for completing improvement actions, and each action has a different impact on the score depending on the potential risks involved. That weighting matters: a score built by completing many low-impact actions and none of the high-impact ones looks healthy and is not, which is why we read the actions rather than the number.
The controls automation cannot test
This is the part implementations underestimate. Improvement actions are technical or nontechnical, and nontechnical actions are documentation or operational. For actions implemented in Defender for Cloud the rule is stated plainly: technical actions are automatically tested and monitored, and non-technical actions must be manually tested. Governance, training and process controls need an owner and a cadence.
Shared responsibility made explicit
Compliance Manager tracks Microsoft managed controls, your controls, and shared controls where both parties have responsibility. Knowing which category a requirement falls into prevents two opposite errors: assuming Microsoft covers something they do not, and re-implementing something they already do and evidence on your behalf.
Alerting on change rather than reporting on state
Alerts can notify on a change in implementation or test status, or an increase or decrease in score. That inverts the model. Instead of somebody remembering to look at a dashboard, the platform tells you when a control that was passing has stopped, which is the only version of continuous monitoring that survives a busy quarter.
Evidence retained as it accumulates
Evidence files and links attach to the improvement action itself. One detail is worth designing around: evidence can be deleted only before the action reaches a pass or fail status, because once test status is Passed, Failed or Out of scope, evidence files and links can no longer be deleted. Upload deliberately rather than provisionally.
Testing history you can export
Testing history exports to an Excel file, and Microsoft notes these reports are especially helpful for automatically tested actions since they update regularly based on tenant data. That export is what turns continuous monitoring into audit evidence: not the current status, but the record that the control held throughout the period.
Automation tests technical controls. Non-technical controls still need a person.
Microsoft states the split directly for actions implemented in Defender for Cloud: technical actions are automatically tested and monitored, and non-technical actions must be manually tested.
- Improvement actions are technical or nontechnical, and nontechnical actions come in two kinds, documentation and operational. Those are the policy, procedure, training and governance requirements, which is to say most of the requirements a framework audit actually spends its time on.
- The failure mode is predictable. Automation is enabled, the score rises quickly as technical actions test clean, and the non-technical actions sit at not implemented indefinitely because nothing prompts anyone. The dashboard looks like progress and the audit finds the same governance gaps as last year.
- The design answer is to treat non-technical actions as scheduled work with named owners and a review cadence, monitored the same way an automated test result is. An improvement action can be assigned to a user, who receives an email with a direct link, and evidence attaches to the action itself.
- One constraint to design around: testing source cannot be changed on actions for services supported by Defender for Cloud, and an action set to automatic testing can otherwise be changed to manual. Deciding that deliberately, per action, is part of the implementation rather than something to discover later.
Four things that decide whether this lasts past month three.
We assign every non-technical action before go live
Non-technical actions are documentation and operational, and they must be manually tested where they sit under Defender for Cloud. Unassigned, they remain at not implemented forever while the score rises on technical actions. Assigning them, with a named owner and a cadence, is the single change that makes the whole thing hold.
We read the actions, not the score
Each action has a different impact on the score depending on the potential risks involved, so a rising number can be produced by completing many low-impact actions while the high-impact ones stay open. Reporting the number without the weighting behind it is how a board acquires confidence that the evidence does not support.
We separate your controls from Microsoft managed controls
Compliance Manager tracks Microsoft managed, customer managed and shared controls. Confusing them causes two opposite errors, assuming Microsoft covers something they do not and duplicating something they already implement and evidence. Making the boundary explicit at design time prevents both, and it shortens the audit conversation considerably.
We configure alerting so nobody has to remember
Alerts fire on changes in implementation or test status and on score increases or decreases. That is the difference between monitoring and a dashboard: monitoring tells you when something that was passing stopped. A dashboard waits for somebody to have a quiet afternoon, and quiet afternoons are rarer than compliance drift.
Four phases across roughly six to eight weeks.
- 01Weeks 1 to 2
Choose the frameworks and build the assessments
Over 360 regulatory templates are available, with availability depending on the licensing agreement, and custom templates can be created for unique needs. Choosing three that matter beats enabling twelve that produce noise, because every assessment adds improvement actions somebody has to own.
- Applicable frameworks selected and justified
- Assessments created and scoped to in-scope services
- Custom template requirements identified
- Baseline score captured against the data protection baseline
- 02Weeks 3 to 4
Enable and validate the automation
Automatic testing is on by default for eligible actions and the settings can be adjusted to test only certain actions or turned off entirely. The work here is validating that the signals arrive and the results are correct, and noting that improvement action statuses refresh every 24 hours before concluding anything is broken.
- Automation signal sources confirmed and connected
- Defender for Cloud subscription monitoring validated
- Automatic testing settings decided per action
- Results sanity checked against known configuration
- 03Weeks 5 to 6
Assign the non-technical actions
The phase that determines whether this survives. Every non-technical action gets a named owner who receives the assignment by email, a due date, and a review cadence. Documentation and operational actions do not test themselves, and unassigned they will still be at not implemented at the next audit.
- Non-technical actions assigned to named owners
- Review cadence agreed per action
- Evidence expectations set before status is finalised
- Assessor role assigned for validation work
- 04Weeks 7 to 8
Alerting, reporting and handover
Alerts configured for status and score changes so drift surfaces without anyone remembering to look. Reporting agreed for management and for audit, including testing history export. Then handover, or continued operation by us if the organisation would rather not carry it.
- Alert policies configured for status and score change
- Management and audit reporting agreed
- Testing history export process established
- Handover, or an agreed ongoing operating model
Six situations where continuous monitoring pays for itself.
A regulated firm carrying several frameworks at once
Where a firm holds regulatory obligations alongside a certification and customer commitments, the overlap is substantial and the duplication is expensive. Common actions synchronise across groups, so implementing one action can meet several requirements across multiple regulations, which is precisely where the effort saving comes from.
An organisation that has just certified
Certification produces a control set that is accurate on the day and drifts immediately afterwards. Continuous monitoring is what keeps the surveillance visit from becoming a repeat of the original project, and the testing history export is what evidences that the controls held through the period rather than on the day.
A provider whose data protection obligations are constant
Where the obligation is continuous rather than periodic, testing annually is a poor match for the risk. Built-in automation receives signals from Data Lifecycle Management, Information Protection, Data Loss Prevention, Communication Compliance and Insider Risk Management, which covers a large part of what a data protection obligation actually requires.
An operator with a multicloud estate
Defender for Cloud integration provides continuous monitoring across Azure, AWS and Google Cloud Platform, evaluated at the subscription level, with the overall score for an action aggregated from individual subscription scores. For estates spread across providers, that subscription level detail is what makes the position actionable rather than directional.
A lean team that cannot run manual control testing
Where two or three people carry compliance alongside everything else, annual manual testing is what gets deferred. Automatic testing on by default for eligible actions, refreshing every 24 hours, moves the technical half off the team entirely and leaves them the half that genuinely needs judgement.
A business that struggled with evidence at the last audit
Where the previous audit was difficult because evidence had to be reconstructed, attaching evidence to improvement actions as work happens changes the pattern. The constraint to plan for is that evidence cannot be deleted once an action reaches Passed, Failed or Out of scope, so upload discipline needs to be set early.
How UAE organisations track compliance between audits.
| Feature | Continuous monitoring, operated | Monitoring enabled, not operated | Annual reconstruction |
|---|---|---|---|
Technical control state tested | Every 24 hours | Every 24 hours | At audit |
Non-technical actions owned | Named owners | Unassigned | Chased annually |
Drift visible when it happens | Yes | In the data | No |
Alerting on status change | Configured | Not configured | Not available |
Evidence accumulated continuously | Yes | Partly | Assembled at audit |
Score reflects risk weighting | Understood | Read as a number | No score |
Shared responsibility understood | Yes | Assumed | Assumed |
Testing history exportable | Routinely | Available, unused | No |
Effort at audit time | Low | High | Very high |
Second framework marginal cost | Low | Moderate | Full repeat |
What each test status actually tells you.
| Status | What it means | |
|---|---|---|
| Passed | Implementation has been verified by an assessor | |
| Failed low risk | Failed, with the lowest risk weighting of the three failure levels | |
| Failed medium risk | Failed, with intermediate risk weighting | |
| Failed high risk | Failed, with the highest risk weighting | |
| Out of scope | Not relevant to the assessment and does not contribute to the score | |
| Not assessed | The action has not been tested | |
| Partially tested | Partially tested, and neither passes nor fails | |
| To be detected | Automatic testing is awaiting signals that indicate test status | |
| Could not be detected | Automatic testing could not detect a status, and will check again | |
| Could not be determined | A manual status for when testing did not reach a conclusion |
Five steps, and step four is the one that determines success.
- 1
Select the frameworks that genuinely apply
Over 360 regulatory templates exist and availability depends on the licensing agreement, with custom templates available for unique needs. Selecting three that matter produces a workable action list. Enabling twelve produces several hundred actions nobody owns, which is worse than not starting.
- 2
Build assessments and capture the baseline
Assessments scoped to the in-scope services, with the initial score captured before any changes. Compliance Manager provides an initial score based on the Microsoft 365 data protection baseline, and knowing where you started is what makes later movement interpretable.
- 3
Enable and validate automation
Signal sources connected, Defender for Cloud subscription monitoring validated, and automatic testing settings decided deliberately per action rather than left at default without review. Results checked against known configuration, remembering that statuses refresh every 24 hours before concluding a signal has failed.
- 4
Assign owners to everything automation cannot test
Every documentation and operational action gets a named owner, a due date and a review cadence. Assignment sends the owner an email with a direct link to the action. An assessor is nominated to validate completed work and set the test status, which is a distinct role from doing the work.
- 5
Configure alerting and agree the reporting
Alerts on implementation and test status changes and on score movement, so drift arrives rather than waiting to be found. Management and audit reporting agreed, including testing history export. Then handover, or we continue operating it under a managed arrangement.
What organisations ask about continuous compliance monitoring.
Fifteen decisions to make before you enable anything.
Scope
- Which frameworks genuinely apply to us?Three that matter beats twelve.
- Which templates does our licensing include?Availability depends on the agreement.
- Do we need a custom template?For unique requirements.
- Which cloud services are in scope?Azure, AWS and GCP are supported.
- What is our baseline score today?Capture it before changing anything.
Automation
- Which actions stay on automatic testing?On by default for eligible actions.
- Which actions do we want tested manually?Not possible for Defender for Cloud services.
- Which Purview solutions are we licensed for?They feed built-in automation.
- Is Secure Score integration meaningful for us?It supplies complementary signals.
- Do the connectors cover our other services?Salesforce and Zoom available now.
Operation
- Who owns each non-technical action?Named, not a team.
- Who holds the assessor role?Validation is a separate permission.
- What triggers an alert to whom?Status change and score change.
- When do we upload evidence?It cannot be deleted after pass or fail.
- Who reviews pending updates?Accepted changes are permanent.
The pages around this one.
Filter your improvement actions to non-technical, and count the ones with an owner.
Automation handles the technical half whether or not anybody manages it. The non-technical half is the half an audit examines, and the number with a named owner tells you where you actually are.
Related Services
Explore more solutions that work great with this service
Compliance as a Service
Keeping the position true between assessments
Audit Readiness Assessment
Run the audit before the auditor does
Microsoft Purview
Data governance and compliance solutions
Gap Assessment
Distance to a target you actually have to meet
ISO 27001 Certification UAE
The 2022 edition, and whether you should certify at all
CIS Controls Assessment
Eighteen controls, assessed and re-assessed
Virtual CISO Dubai
Security governance and accountability, not more tools
IT Audit Services Dubai
Assessment, technical test or certification, scoped properly