V3I2P42

Continuous Compliance: Turning Cyber Controls into Always-On, Verifiable Evidence

Ayomipo Alademehin^1*

Abstract

Cybersecurity compliance is shifting from periodic, point-in-time assessments toward ongoing evidence and assurance expectations driven by cloud-native systems, DevSecOps practices, and expanding regulatory and contractual requirements. Yet the term “continuous compliance” remains conceptually ambiguous and inconsistently operationalized across cybersecurity, IT risk management, governance risk and compliance (GRC), and audit assurance communities. This fundamentals paper conceptualizes continuous compliance in Information Systems (IS) research using a multivocal review of standards, assurance guidance, and academic work. It introduces a core conceptual model consisting of seven interacting aspects: compliance obligations, risk appetite and governance, control design and implementation, evidence and telemetry, assurance actors and accountability, compliance automation infrastructure, and trust and transparency outcomes. The model is discussed through contemporary field examples (SOC 2 for cloud services, PCI DSS environments, and ISO/IEC 27001 programs) and results in a structured research agenda spanning design science research (DSR) and behavioral research.

Keywords:

continuous compliance; cybersecurity governance; IT risk management; GRC; continuous control monitoring; audit evidence; compliance automation; policy-as-code