A NEW WAVE OF CONTINUOUS CONTROLS MONITORING IS HERE

Continuous Controls Monitoring (CCM) comprises a set of technologies that work to help an organisation cut down losses by constantly monitoring controls. This insightful article takes us through ‘Traditional Controls Monitoring Vs Continuous Controls Monitoring’

-  Sushil Mahar

Continuous Controls Mon-itoring (CCM) comprises a set of technologies that work to help organisations cut down losses by constantly monitoring controls. These technologies automatically and continuously inspect controls, thereby bringing down audit costs. While the CCM concept is new to some organisations, a few others are still contemplating its implementation. However, quite a few companies have realised the many tangible benefits CCM offers. The new wave of continuous controls monitoring is already here.

TRADITIONAL CONTROLS MONITORING VS. CONTINUOUS CONTROLS MONITORING

Organisations have been identifying and implementing cybersecurity controls to protect their assets, ensure business continuity and stay compliant with mandatory regulations. However, despite being well-documented and deployed, these controls may not be well-monitored, leading to lapses. In many organisations, control monitoring is exception-based.

If we consider the traditional scenario, change management, financial processes, HR, incident management, and general IT controls — SoD, access controls, configuration controls, exceptions, etc. — are monitored via various department-based, division-based, or activity-based controls. A team monitors these controls regularly, but not continuously. Discrepancies are identified and addressed periodically. Furthermore, auditors perform audits on a quarterly, half-yearly, or annual basis to identify gaps and escalate them to the respective teams to resolve.