Information Security Compliance Monitoring Procedure

1. Purpose

The Information Security Compliance Monitoring Procedure defines how the organization continuously monitors, evaluates, records, and reports compliance with applicable information-security requirements.

The procedure helps ensure that the organization remains aligned with:

ISO/IEC 27001 requirements
Applicable Annex A controls
Internal information-security policies and procedures
Legal and regulatory requirements
Customer and contractual security requirements
Supplier and third-party obligations
Security commitments
Internal risk-treatment requirements
Security standards and frameworks adopted by the organization

The objective is not simply to confirm that policies exist, but to determine whether required security requirements are:

Defined
Implemented
Operating
Supported by evidence
Monitored
Reviewed
Corrected when gaps are identified

Core Principle

Identify Requirements → Map Controls → Monitor → Collect Evidence → Assess Compliance → Record Findings → Correct → Verify → Report → Improve

2. Scope

This procedure applies to information-security compliance activities covering:

Information-security policies
ISMS requirements
Security controls
Information assets
Applications
Cloud environments
Infrastructure
Access management
Employees and contractors
Suppliers and third parties
Customer security commitments
Personal-data protection
Security operations
Business continuity
Incident management
Vulnerability management
Application security
AI systems where applicable
Legal and regulatory obligations
Contractual security requirements

The scope should align with the organization’s defined ISMS scope.

3. When to Use

Compliance monitoring should be performed:

Periodically according to risk
During internal reviews
During control testing
Before certification or surveillance audits
Following significant security changes
Following regulatory changes
Following customer requirement changes
Following security incidents
Following major supplier changes
When new systems or services are introduced
When significant compliance gaps are identified

4. Compliance Monitoring Information

Field	Details
Monitoring ID
Monitoring Period
ISMS Scope
Reviewer
Compliance Owner
Business Owner
Applicable Framework
Applicable Requirements
Review Date
Next Review Date
Status

5. Compliance Requirements

Identify the requirements that apply to the organization.

Internal Requirements

☐ Information-security policy
☐ Access-control requirements
☐ Password/authentication requirements
☐ Incident-management requirements
☐ Backup requirements
☐ Logging requirements
☐ Vulnerability-management requirements
☐ Supplier-security requirements
☐ Business-continuity requirements
☐ Data-protection requirements
☐ Security-awareness requirements
☐ Other internal requirements

External Requirements

☐ ISO/IEC 27001
☐ Applicable privacy requirements
☐ Customer contractual requirements
☐ Supplier contractual requirements
☐ Industry requirements
☐ Regulatory requirements
☐ Certification requirements
☐ Security framework requirements
☐ Other applicable standards

6. Requirement Identification

For each applicable requirement, document:

Requirement ID	Requirement	Source	Applicability	Owner	Review Frequency

Requirements should be reviewed when:

New laws or regulations become applicable
New contracts are signed
New customers introduce security requirements
New services are launched
Business operations change
The ISMS scope changes
New technology is introduced

7. Requirement-to-Control Mapping

Map applicable requirements to the controls or processes used to address them.

Requirement	Control/Process	Owner	Evidence	Monitoring Method	Status

A single requirement may be supported by multiple controls.

A single control may also support multiple requirements.

8. Compliance Monitoring Methods

Compliance may be monitored using:

☐ Document review
☐ Evidence review
☐ Interviews
☐ Observation
☐ Sampling
☐ Control testing
☐ System configuration review
☐ Access review
☐ Log review
☐ Vulnerability review
☐ Security testing
☐ Supplier review
☐ Contract review
☐ Automated monitoring
☐ Internal audit
☐ Independent review
☐ Management review

The monitoring method should be appropriate to the requirement and associated risk.

9. Compliance Monitoring Frequency

Monitoring frequency should be risk-based.

Example

Risk	Example Frequency
Low	Annual
Medium	Semiannual
High	Quarterly
Critical	Monthly or continuous

These frequencies are examples and should be adjusted according to organizational risk.

Certain technical controls may require continuous or automated monitoring.

10. Compliance Monitoring Plan

Prepare a monitoring plan covering the applicable compliance areas.

Month	Area	Requirement	Control
January	Access	Internal policy	Access review
February	Cloud	Security standard	Cloud controls
March	Suppliers	Supplier requirements	Supplier review
April	Vulnerability	Security procedure	Vulnerability management
May	Incident	Incident procedure	Incident records
June	Backup	Backup requirements	Backup testing
July	BCP	Continuity requirements	BCP controls
August	Privacy	Applicable requirements	Privacy controls
September	Application	Security requirements	App security
October	Contracts	Customer requirements	Contract review
November	ISMS	ISO requirements	Internal review
December	Annual	Compliance program	Annual assessment

11. Evidence Collection

Collect evidence sufficient to demonstrate compliance.

Examples include:

Policies
Procedures
Risk assessments
Statement of Applicability
Access review records
MFA configuration
Security logs
Vulnerability reports
Penetration-test reports
Incident records
Backup test results
Business continuity tests
Supplier assessments
Training records
Security review reports
Contracts
Data-processing agreements
Customer requirements
System configurations
Change records
Monitoring reports

Evidence Principle

The objective is to demonstrate that the control operates, not merely that the control document exists.

12. Evidence Quality Assessment

Evaluate evidence for:

☐ Relevance
☐ Completeness
☐ Accuracy
☐ Current status
☐ Traceability
☐ Authenticity
☐ Appropriate time period
☐ Appropriate system/source
☐ Reviewer verification

Avoid retaining unnecessary:

Passwords
API keys
Private keys
Authentication secrets
Production credentials
Sensitive personal information

13. Compliance Assessment

Each requirement should be assessed.

Suggested Status

☐ Compliant
☐ Partially Compliant
☐ Non-Compliant
☐ Not Applicable
☐ Further Evidence Required
☐ Under Remediation

Assessment Questions

Is the requirement applicable?
Has an appropriate control been defined?
Has the control been implemented?
Is the control operating?
Is sufficient evidence available?
Is the evidence current?
Are there exceptions?
Are there known gaps?
Has the associated risk been assessed?

14. Compliance Monitoring Register

ID	Requirement	Control	Evidence	Status	Finding	Risk	Owner	Due Date

The register should provide traceability from the requirement to the evidence and final compliance conclusion.

15. Compliance Exceptions

Document approved exceptions.

Exception ID	Requirement	Reason	Risk	Compensating Control	Approver	Expiry

Exceptions should:

Have a documented business/security justification
Include risk assessment
Identify compensating controls where applicable
Have an appropriate approval
Have an expiry or review date
Be periodically reassessed

16. Non-Compliance

Non-compliance may include:

Required control not implemented
Required control not operating
Required evidence unavailable
Policy requirement not followed
Contractual requirement not met
Regulatory requirement not addressed
Security configuration inconsistent with approved requirements
Required review not completed
Access not reviewed
Security testing not completed
Corrective action overdue

Each significant non-compliance should be recorded and risk assessed.

17. Compliance Finding

Record findings using:

Field	Details
Finding ID
Requirement
Expected Condition
Actual Condition
Evidence
Risk
Root Cause
Affected Asset/Process
Corrective Action
Owner
Due Date
Status

Finding Principle

Requirement + Evidence + Condition + Risk = Defensible Finding

18. Risk Assessment

Compliance gaps should be evaluated based on their potential impact.

Consider:

Confidentiality
Integrity
Availability
Privacy
Customer impact
Regulatory impact
Contractual impact
Financial impact
Operational impact
Reputational impact
Security impact

Risk Treatment

☐ Reduce
☐ Avoid
☐ Share/Transfer
☐ Accept

Risk acceptance should follow the organization’s approved risk-management process.

19. Corrective Action

For identified gaps:

Record the finding
Assess risk
Identify immediate correction where necessary
Determine root cause
Define corrective action
Assign owner
Set target date
Implement action
Collect remediation evidence
Verify effectiveness
Update residual risk
Close or escalate

20. Corrective Action Register

Action ID	Finding	Action	Owner	Due Date	Status	Evidence	Verified

A finding should not be considered closed solely because the owner reports that the action is complete.

Closure should be supported by evidence and verification.

21. Continuous Compliance Monitoring

Where technically and economically appropriate, automate monitoring.

Examples:

Cloud

IAM configuration
MFA
Security groups
Encryption
Logging
Backup
Public exposure

Endpoint

Security agents
Encryption
Patch status
Unsupported systems

Applications

Vulnerabilities
Dependency risks
Secrets
Security testing

Identity

Dormant accounts
Privileged accounts
MFA status
Access changes

Infrastructure

Configuration deviations
Security patches
Logging
Network exposure

Automation should generate alerts or evidence that can be reviewed by responsible personnel.

22. Cloud Compliance Monitoring

For an AWS SaaS environment, monitor relevant areas such as:

☐ IAM
☐ MFA
☐ Privileged access
☐ CloudTrail
☐ Logging
☐ S3 security
☐ Encryption
☐ Security groups
☐ Network controls
☐ Backup
☐ Public exposure
☐ Vulnerability management
☐ Configuration changes
☐ Secrets management

Example

If an AWS production S3 bucket becomes publicly accessible:

Detection → Alert → Investigation → Risk Assessment → Immediate Correction → Root Cause → Corrective Action → Verification → Record

23. Access Compliance Monitoring

Periodically verify:

☐ User access is authorized
☐ Access matches job responsibilities
☐ Privileged access is justified
☐ MFA is enabled
☐ Terminated users are removed
☐ Dormant accounts are reviewed
☐ Service accounts are controlled
☐ Supplier access is reviewed
☐ Temporary access expires
☐ Access reviews are documented

24. Security Policy Compliance

Monitor whether operational practices follow approved policies.

Examples:

Policy	Monitoring Evidence
Access Control Policy	Access review
Password Policy	Authentication configuration
Backup Policy	Backup reports
Incident Policy	Incident records
Supplier Policy	Supplier reviews
Vulnerability Policy	Vulnerability reports
Change Management Policy	Change records
Data Retention Policy	Retention configuration
Security Awareness Policy	Training records

25. Contractual Compliance Monitoring

Review customer and supplier obligations.

Verify:

☐ Security commitments identified
☐ Contract requirements mapped
☐ Responsible owner assigned
☐ Required controls implemented
☐ Evidence available
☐ Reporting requirements met
☐ Incident obligations understood
☐ Data-processing obligations addressed
☐ Review dates established

26. Regulatory Compliance Monitoring

Monitor applicable legal and regulatory obligations.

The organization should maintain a current register of applicable requirements.

Requirement	Jurisdiction	Applicability	Owner	Control	Evidence	Review Date

Changes should be assessed for impact on:

Policies
Controls
Contracts
Processes
Systems
Training
Risk assessments

27. Customer Security Requirement Monitoring

For customers with specific security requirements:

☐ Requirements identified
☐ Requirements documented
☐ Control mapping completed
☐ Owner assigned
☐ Evidence available
☐ Contract obligations reviewed
☐ Exceptions approved
☐ Customer reporting completed where required

Customer-specific requirements should not be lost after contract signing.

28. Supplier Compliance Monitoring

Monitor critical suppliers for:

☐ Security assurance
☐ Security incidents
☐ Vulnerabilities
☐ Subprocessors
☐ Data locations
☐ Contract changes
☐ Security certifications
☐ Business continuity
☐ Access
☐ Material service changes

Critical suppliers should be monitored according to their risk.

29. Security Awareness Compliance

Monitor:

☐ New employee training
☐ Annual security awareness
☐ Role-specific training
☐ Phishing awareness where applicable
☐ Policy acknowledgement
☐ Training completion
☐ Overdue training

Evidence

30. Vulnerability and Patch Compliance

Monitor:

☐ Vulnerability scanning
☐ Critical vulnerabilities
☐ High-risk vulnerabilities
☐ Patch compliance
☐ Exceptions
☐ Remediation timelines
☐ Retesting
☐ Unsupported software

Metrics

Critical vulnerabilities open
High vulnerabilities open
Average remediation time
Overdue vulnerabilities
Patch compliance percentage

31. Incident Compliance Monitoring

Review whether security incidents were handled according to defined requirements.

Verify:

☐ Incident reported
☐ Severity assessed
☐ Escalation completed
☐ Evidence preserved
☐ Required notifications completed
☐ Corrective action recorded
☐ Root cause reviewed
☐ Lessons learned documented

Incident trends should be considered as compliance-monitoring inputs.

32. Business Continuity Compliance

Monitor:

☐ BCP current
☐ DR plan current
☐ RTO/RPO defined
☐ Backup operating
☐ Recovery testing completed
☐ Critical dependencies identified
☐ Recovery actions documented
☐ Test findings addressed

33. Compliance Dashboard

Management may monitor metrics such as:

Metric	Target	Actual	Status
Requirements monitored
Compliant requirements
Partial compliance
Non-compliance
Open findings
Overdue actions
High-risk findings
Closed findings
Control tests completed
Supplier reviews completed
Access reviews completed
Security training completion

34. Compliance Status Reporting

Compliance reports should summarize:

Monitoring performed
Requirements reviewed
Controls assessed
Evidence reviewed
Compliant areas
Partial compliance
Non-compliance
Significant risks
Overdue actions
Exceptions
Changes since previous review
Recommended improvements

35. Management Reporting

Significant compliance issues should be communicated to appropriate management.

Management reporting may include:

Significant non-compliance
High or critical risks
Repeated findings
Overdue corrective actions
Regulatory changes
Major contractual gaps
Security incidents affecting compliance
Material supplier issues
Major control failures

36. Trend Analysis

Compliance monitoring should identify trends rather than only individual findings.

Review:

☐ Repeated findings
☐ Increasing non-compliance
☐ Recurring overdue actions
☐ Control failures
☐ Supplier issues
☐ Access issues
☐ Vulnerability trends
☐ Incident trends
☐ Training gaps
☐ Audit findings

Example

If the same access-review finding occurs three consecutive periods, investigate whether the issue is a:

Process weakness
Ownership problem
Technology limitation
Training issue
Resource issue
Control-design problem

37. Effectiveness Assessment

Compliance monitoring should determine whether controls are effective.

Assess:

Design Effectiveness

Does the control adequately address the requirement?

Implementation

Has the control actually been implemented?

Operating Effectiveness

Does the control consistently operate as intended?

Evidence

Can the organization demonstrate operation?

Result

☐ Effective
☐ Partially Effective
☐ Ineffective
☐ Not Tested

38. Relationship With Internal Audit

Compliance monitoring and internal audit are related but different activities.

Compliance Monitoring

Primarily focuses on:

Ongoing compliance
Requirement tracking
Control status
Evidence
Exceptions
Corrective actions

Internal Audit

Provides a more structured and independent assessment of whether the ISMS and controls meet defined audit criteria.

Compliance monitoring can therefore provide useful inputs to the internal audit program.

39. Relationship With Management Review

Compliance-monitoring results may provide management-review inputs including:

Compliance status
Regulatory changes
Customer requirements
Security findings
Control effectiveness
Open corrective actions
Significant risks
Supplier issues
Incident trends
Improvement opportunities

40. Roles and Responsibilities

Role	Responsibility
Management	Provide oversight and resources
ISMS Manager	Coordinate compliance monitoring
Compliance Owner	Maintain requirements and assessments
Control Owner	Operate and provide evidence for controls
Risk Owner	Assess and treat risks
IT/Security Team	Provide technical evidence
Legal/Privacy	Review applicable legal/privacy requirements
Procurement	Support supplier requirements
Internal Auditor	Independently assess where applicable
Employees	Follow applicable security requirements

41. Records

Maintain appropriate records including:

☐ Compliance requirements register
☐ Requirement-to-control mapping
☐ Compliance monitoring plan
☐ Monitoring results
☐ Evidence
☐ Compliance findings
☐ Exception records
☐ Risk assessments
☐ Corrective actions
☐ Verification records
☐ Compliance reports
☐ Management reports
☐ Review records

Records should be protected against unauthorized modification or disclosure.

42. Records Retention

Compliance records should be retained according to the organization’s approved retention requirements.

Consider:

Legal requirements
Contractual requirements
Certification requirements
Audit requirements
Business requirements
Information sensitivity

Do not retain evidence longer than necessary without a documented reason.

43. Escalation

Escalate compliance issues when:

☐ High/critical risk identified
☐ Regulatory requirement potentially breached
☐ Customer commitment potentially breached
☐ Security control fails materially
☐ Finding becomes overdue
☐ Repeated failure occurs
☐ Significant incident occurs
☐ Risk exceeds approved tolerance

Escalation should follow the organization’s incident, risk, and management escalation processes.

44. Review Triggers

Additional compliance monitoring may be initiated following:

☐ New regulation
☐ Regulatory amendment
☐ New customer requirement
☐ New contract
☐ New supplier
☐ Major supplier change
☐ New system
☐ New cloud service
☐ New production environment
☐ Major organizational change
☐ Security incident
☐ Data breach
☐ Major vulnerability
☐ Significant audit finding
☐ ISMS scope change

Process

Change → Assess Requirement → Assess Impact → Update Controls → Monitor → Verify → Record

45. Annual Compliance Assessment

At least annually, or at a frequency appropriate to risk, perform an overall compliance assessment.

Review:

☐ Applicable requirements
☐ ISMS requirements
☐ Control implementation
☐ Control effectiveness
☐ Legal/regulatory requirements
☐ Contractual requirements
☐ Customer requirements
☐ Supplier requirements
☐ Exceptions
☐ Findings
☐ Corrective actions
☐ Risk changes
☐ Significant changes

46. AWS SaaS Startup Example

Consider a SaaS startup operating its production environment on AWS.

Applicable Requirements

ISO/IEC 27001
Customer security requirements
Internal security policies
Privacy requirements
Supplier requirements

Compliance Monitoring

The organization periodically reviews:

AWS

IAM
MFA
CloudTrail
Encryption
S3 configuration
Security groups
Backup
Logging

Application

Vulnerability management
Dependency security
Security testing
Secure development

People

Security training
Employee access
Joiner/mover/leaver controls

Suppliers

Critical supplier reviews
Security assurance
Subprocessors

Example Finding

Requirement: Privileged AWS accounts must use MFA.

Evidence: Monthly IAM compliance report.

Condition: One privileged account did not have MFA enabled.

Risk: Unauthorized access to production resources.

Immediate Action: MFA enabled.

Root Cause: New administrator account was provisioned outside the standard onboarding workflow.

Corrective Action: Update account provisioning automation to enforce MFA before activation.

Verification: Re-test IAM configuration.

Status: Closed after evidence confirms the control operates correctly.

47. Startup-Friendly Compliance Monitoring Model

A startup does not necessarily need a large compliance team.

Monthly

Review:

Privileged access
MFA
Critical vulnerabilities
Security incidents
Cloud configuration
Backup status
Critical suppliers

Quarterly

Review:

Access
Security policies
Suppliers
Compliance requirements
Risk register
Corrective actions
Control effectiveness

Semiannual

Review:

Business continuity
Disaster recovery
Security awareness
Application security
Contractual requirements

Annual

Review:

Complete compliance program
Legal/regulatory requirements
ISMS controls
Internal audit
Independent review where appropriate
Management review
Compliance improvement plan

48. Common Mistakes

Avoid:

Treating compliance as a once-a-year exercise.
Checking whether policies exist without checking implementation.
Collecting evidence without evaluating it.
Using the same monitoring frequency for every requirement.
Ignoring customer contractual requirements.
Ignoring regulatory changes.
Failing to track exceptions.
Allowing corrective actions to remain indefinitely overdue.
Closing findings without verification.
Relying entirely on manual spreadsheets where automation is practical.
Failing to monitor control effectiveness.
Treating certification as proof of continuous compliance.
Failing to report significant compliance issues to management.

49. Relationship With Other ISMS Documents

Document	Relationship
Information Security Policy	Defines security direction
Legal & Regulatory Requirements Register	Identifies external obligations
Contractual Security Requirements Register	Identifies contractual obligations
Requirement-to-Control Mapping Matrix	Maps requirements to controls
Risk Register	Records compliance-related risks
Statement of Applicability	Documents applicable security controls
Control Testing Procedure	Defines control testing
Internal Audit Procedure	Provides independent audit assessment
Security Findings Register	Records compliance gaps
Corrective Action Tracker	Tracks remediation
Supplier Monitoring Procedure	Monitors supplier compliance
Incident Management Procedure	Handles security incidents
Management Review	Reviews ISMS performance and compliance

50. ISO/IEC 27001 Connection

Information-security compliance monitoring supports the organization’s ability to determine whether its ISMS arrangements and applicable security controls continue to meet defined requirements.

It can provide evidence and inputs for:

Monitoring and measurement
Control effectiveness assessment
Internal audit
Management review
Risk treatment
Corrective action
Continual improvement
Legal, regulatory, contractual, and customer compliance

The Information Security Compliance Monitoring Procedure is not itself a universally prescribed ISO/IEC 27001 form. The organization should define monitoring methods, frequency, responsibilities, evidence, and reporting based on its ISMS scope, risks, objectives, applicable requirements, controls, and business context.

Compliance monitoring should also be distinguished from an internal audit. Monitoring may be continuous or periodic operational activity, while an internal audit is a planned and systematic audit activity performed against defined criteria.

51. Final Compliance Monitoring Audit Trail

For every significant compliance requirement, the organization should be able to demonstrate:

What requirement applies?
Where did the requirement come from?
Why is it applicable?
Which control addresses it?
Who owns the control?
How is compliance monitored?
What evidence was reviewed?
Is the control actually operating?
Were any gaps identified?
What risk does the gap create?
Who owns the corrective action?
Was remediation verified?
What is the remaining risk?
Was management informed where necessary?

Final Principle

Compliance monitoring is not simply checking a box. It is the continuous process of connecting applicable requirements to controls, evidence, operating effectiveness, risk, corrective action, and management oversight.