Continuous monitoring
A passing check mapped to a control is evidence. An unmapped one is a dashboard.
Connected sources that produce evidence
Connect a source, then map what it reports to the controls it satisfies. From then on a check result carries a control reference and a freshness date, and appears to an auditor as an exhibit rather than a claim. Credentials are stored encrypted and never shown back.
Key capabilities
- Check-to-control mapping with assertions
- Freshness tracking per linked control
- Encrypted credential storage with no read-back
- Scheduled synchronisation with visible job history
Compliance watch
Watch rules observe the record and act when something moves out of line: an access that should have been removed, a control that has gone stale, a review past its date. They do not just notify; they raise the record that needs working and suggest what to do.
Key capabilities
- Configurable watch rules across modules
- Raises the record, not just an alert
- Suggested actions attached
- Re-alerting controlled so a standing issue does not become noise
Scheduled jobs and notifications
Integration syncs, posture captures, reminder sweeps, expiry checks and digest emails all run on timers you can see. If a figure looks stale, one screen tells you whether its job ran.
Key capabilities
- Scheduled-job register with last-run state
- Reminder sweeps across policies, reviews, evidence and certificates
- Per-module notification preferences
- Executive posture digest by email
Posture forecasting
Every other panel answers "where do things stand". Forecasting answers "and then what": a projection on each metric's history, with a confidence read from how well the fit holds. It refuses to project a metric with too little history, and says so on screen.
Key capabilities
- Projection per headline metric
- Direction shown as a word as well as an icon
- Confidence as a label, not a false-precision percentage
- Worsening metrics sorted first
Proof point
A check that has not run recently shows as stale, not as passing. Showing last year's success as a current pass is how automated evidence loses an auditor's trust permanently.
Questions about this
What is continuous compliance monitoring?
Automated, ongoing collection of control evidence from connected systems, with control status visible every day instead of reconstructed before an audit.
Do integrations need an agent?
No. Connectors are read-only APIs to cloud, identity, code, ticketing and security tools.
How do auditors treat continuously collected evidence?
Well. It gives them a complete, timestamped population to sample from. They check integrity, which Certifyi provides by hashing each artefact on arrival.
What can monitoring not cover?
Judgement and process: whether the risk assessment is realistic, whether the incident plan was exercised. Those need a person and a record.