What is the BEST way to achieve on-going compliance monitoring in an organization?

On-going compliance monitoring is a continuous process, not a point-in-time event. The most effective approach is a proactive and collaborative partnership between the Compliance and Information Security functions. This ensures that security controls are not only implemented but are also continuously monitored, tested, and improved. When issues are identified, this partnership allows for swift and effective remediation, integrating compliance into the daily operational rhythm of the organization. This approach treats compliance as a sustained state rather than a project to be completed before an audit.

A. This is a reactive, last-minute approach that fails to maintain a consistent state of compliance and often leads to audit failures.
B. While outsourcing can provide expertise, the organization remains ultimately accountable; the best approach requires internal partnership and ownership.
D. Waiting for an auditor's report to fix issues is a reactive and inefficient strategy that indicates a poor compliance posture.

1. National Institute of Standards and Technology (NIST). (2018). Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. Section 3.3, "Communicating Cybersecurity Requirements with Stakeholders." This framework emphasizes continuous improvement and communication between different organizational functions to manage cybersecurity risk.

2. National Institute of Standards and Technology (NIST). (2014). Assessing Security and Privacy Controls in Federal Information Systems and Organizations (NIST Special Publication 800-53A, Revision 4). Section 2.4, "Continuous Monitoring," Page 7. It describes continuous monitoring as a critical part of risk management, requiring ongoing awareness and coordinated actions.