# Continuous Compliance Standards Reference

## Primary Frameworks

### NIST SP 800-137 — Information Security Continuous Monitoring
- **Publisher**: NIST (2011)
- **Application**: Foundational methodology for continuous monitoring adapted to privacy compliance
- **Key Concepts**: Ongoing awareness, risk management, organizational response

### GDPR Accountability Principle (Art. 5(2))
- **Requirement**: Controller shall be able to demonstrate compliance at any time
- **Application**: Continuous monitoring provides real-time demonstrability vs. point-in-time audits

### ISO 27001:2022 Clause 9 — Performance Evaluation
- **9.1**: Monitoring, measurement, analysis and evaluation
- **9.2**: Internal audit
- **9.3**: Management review
- **Application**: ISMS continuous monitoring requirements extend to PIMS via ISO 27701

## GRC Platforms
- OneTrust GRC (compliance management, evidence collection)
- ServiceNow GRC (workflow automation, finding management)
- LogicGate (risk management, compliance workflows)
- Hyperproof (evidence collection, compliance mapping)
- Vanta (automated compliance monitoring for SOC 2, ISO 27001)
- Drata (continuous compliance automation)

## Compliance-as-Code Tools
- Open Policy Agent (OPA) — policy enforcement for cloud infrastructure
- HashiCorp Sentinel — policy-as-code for Terraform
- AWS Config Rules — automated configuration compliance
- Azure Policy — cloud resource compliance enforcement
- Checkov — infrastructure-as-code static analysis

## Key Publications
- NIST SP 800-137: Information Security Continuous Monitoring for Federal Systems
- ISACA COBIT 2019: Monitoring, Evaluation and Assessment
- Gartner: Market Guide for GRC Solutions for Privacy
- Forrester: The GRC Technology Landscape, 2024