← All Blogs

Continuous compliance or an annual panic? No framework asks for the panic

By Best IT MSP Editorial Team - Updated October 21, 2026 - 12 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Does any compliance framework ask for an annual audit panic?

No. Not one framework describes that pattern anywhere in its own text. ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system. Maintaining and continually improving are present tense verbs. They describe a system that runs, not a point-in-time snapshot you assemble in the six weeks before an assessor arrives.

The rules that bind US small businesses say the same thing in their own words. The HIPAA Security Rule tells covered entities to review and modify the security measures implemented under this subpart as needed, so that protection carries on. The CMMC regulation makes a senior official affirm continuing compliance with the security requirements, at the time of each assessment, and annually thereafter. The FTC Safeguards Rule puts continuous monitoring ahead of periodic testing inside its own sentence.

We built this from the rule text rather than from compliance software marketing. Continuous compliance is a crowded sales category, and the firms selling the platform wrote most of what ranks for the phrase.

• The sources. Every requirement below is quoted from the AICPA, ISO and IEC, NIST, FedRAMP, or the text of the HIPAA Security Rule, the FTC Safeguards Rule, the CMMC regulation and New York's Part 500.
• The exclusions. We use no compliance-automation vendor's own statistics, because that software is what a reader gets sold off the back of this topic.
• Not audit or legal advice. Your auditor and your counsel own the final call on your scope and your obligations.
• Independence. Best IT MSP is an independent directory. We rank providers on verified rating and firmographic data, we label paid placement, and we do not sell IT services.

So where does the annual panic come from? It is an artifact of how the evidence gets collected, not a requirement anybody wrote down. A control that produces a record only when somebody goes looking has to be reconstructed every year, and reconstruction takes six weeks.

How long does a SOC 2 observation period have to be?

There is no mandatory minimum, and the number the AICPA does publish is not the one you have been told. Its SOC 2 guide works through the case where a service organization wants an examination covering a period of less than two months, and says the auditor should consider whether a report covering that period will be useful to users of the report, particularly if many of the controls related to the applicable trust services criteria are performed on a monthly or quarterly basis. That is a usefulness test, not a validity rule, and the figure in it is two months. Beyond that the provider and its CPA firm agree the dates between themselves.

Note what that is not. The three month floor repeated across the internet is not the AICPA's number, and it is not in the AICPA's guide. The guide's figure is two months, and it is a prompt for the auditor to think about usefulness rather than a line below which a report cannot be issued. One caveat on our own reading: the current edition of that guide is sold as a book, so the copy we read is the 2011 edition held in a university archive, and the paragraph is numbered differently in later editions. The consequence for you is the same either way. A provider holding a Type 2 report that covers three months and a provider holding one that covers twelve months say the identical four words to you. Read the dates on the report, every time.

Other bodies publish numbers when they intend one, which is how you know the silence is real. CMMC states that a Level 2 certification assessment must be completed within three years of the CMMC Status Date. FedRAMP requires Critical and High risks to be remediated within 30 days of discovery, Moderate risks within 90 days of discovery, and Low risks within 180 days of discovery. New York's Part 500 requires penetration testing by a qualified internal or external party at least annually. Each of those is a clock somebody chose to publish.

One published number does bind a CMMC holder between assessments. A conditional status requires the plan of action to be closed out within 180 days of the CMMC Status Date, and the status lapses if it is not. Three years is the gap between assessments. It is not three years of silence.

What do compliance frameworks require between assessments?

Between assessments the frameworks require monitoring that runs on its own, and they name a fixed cadence only when that monitoring is missing. The FTC Safeguards Rule is the clearest example in US law. It tells a firm to regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, and then spells out the alternative.

Read the order of that sentence carefully. The rule says the monitoring shall include continuous monitoring or periodic penetration testing and vulnerability assessments. It then says that absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities, a firm must conduct annual penetration testing plus vulnerability assessments at least every six months.

The annual schedule is the fallback for not having continuous monitoring, not the goal. That is the most useful line in the rule for a small business, and almost nobody reads it that way. A fixed calendar of once-a-year tests is what the regulator asks for when nothing watches the system for the other 364 days.

New York's Part 500 builds the same expectation into its vulnerability management section. Covered entities run automated scans of information systems, and a manual review of systems not covered by such scans, at a frequency determined by the risk assessment, and promptly after any material system changes. They must also be promptly informed of new security vulnerabilities by having a monitoring process in place, and then timely remediate vulnerabilities in priority order. A monitoring process in place is not an annual event. It is the thing an annual test is supposed to confirm.

Why can an annual scramble not produce a year of evidence?

An annual scramble fails for a plain arithmetic reason. For several common controls the raw data has already been deleted by the time anybody goes looking for it. Microsoft's own documentation is the cheapest place to see this, because it publishes the defaults.

On Microsoft Entra ID Free, audit logs and sign-ins are each retained for Seven days. On Entra ID P1 and P2 both are retained for 30 days. Seven days is two percent of a year. Thirty days is eight percent. No amount of effort in week fifty recovers week three.

Then comes the part that catches people out. Microsoft states that log retention changes aren't retroactive, and that data which has already expired can't be recovered unless it was previously archived. Buying the premium license in month eleven does not produce months one to ten. The Purview audit documentation says the same thing about its own pipeline, noting that changes to licensing or retention don't update any previously committed items.

Microsoft 365 audit records last longer and still fall short of a full year. The default retention period for Audit (Standard) changed from 90 days to 180 days, and holding records beyond 180 days and up to one year requires an Office 365 E5 or Microsoft 365 E5 license. Those are the defaults your audit evidence sits on, whoever administers the tenant.

Network gear is worse. Sophos reported that cases hampered by missing logs doubled over the previous year, largely driven by firewall appliances where the default was only seven days, and in some cases, 24 hours. A firewall change review that happened in March leaves nothing behind in October, if the appliance kept a week.

How do you tell whether a control produces continuous evidence?

To tell, ask what the control produces on an ordinary Tuesday, and who reads that output. Two answers settle it. A control that emits a dated record nobody had to request is being operated. A control whose evidence appears only when somebody asks is being described.

NIST's assessment vocabulary draws the same line, and it explains why a reconstructed document passes one kind of check and fails another. To examine is to check, inspect, review or analyze an object in order to obtain evidence. To test is exercising one or more assessment objects under specified conditions to compare actual with expected behavior. A screenshot made last week survives an examination. It cannot survive a test, because there is nothing left to exercise. A dated record from a scheduled job stays verifiable months later.

A control that only produces evidence when somebody asks for it is a control nobody is operating.

Sort every control your provider claims into three buckets, then work on the third one.

• Emits by default. The control writes a dated record whether anybody asks or not. Endpoint alerts, patch deployment logs and backup job results usually sit here.
• Could emit, but nobody switched it on. The data exists and the report is one setting away. Access review exports, mailbox audit records and firewall change logs usually sit here.
• Emits nothing. The only evidence is a person writing a document later. Vendor reviews, exception approvals and tabletop exercises usually sit here, so schedule these first.

NIST names the destination plainly. Information security continuous monitoring means maintaining ongoing awareness of information security, vulnerabilities, and threats to support risk decisions. Ongoing awareness is a reading habit rather than a storage product. Somebody has to read the output, and that person belongs in your service level agreement by name. The same goes for control ownership on anything you and your provider share.

How fast does a control drift out of compliance?

A control drifts within days, and published exposure windows are the best measurable proxy for it. Verizon ran a survival analysis of third-party cloud-based multi-factor authentication exposures and found 58 percent still unresolved at day 7, 50 percent at day 28, 42 percent at day 90 and 32 percent at day 240. Almost a third were still open eight months later.

The measuring stick also moves when you do not. CISA's catalog of known exploited vulnerabilities showed 1,754 entries on the day we read it, 21 October 2026. An asset list judged compliant in January gets assessed against a longer list in June. Verizon separately found only 26 percent of critical vulnerabilities in the CISA known exploited catalog were fully remediated in 2025, down from 38 percent, and that the median time for full resolution of one went up to 43 days.

Compare that with the attacker's clock. Sophos put median dwell time at three days across 661 incident response and managed detection cases. An annual cycle verifies a control once in 365 days. Vendor risk works the same way, and your IT provider is usually the largest single entry on that list.

How do you get your provider to send evidence every month?

Ask your provider to turn the reports you already rely on into scheduled monthly exports, then ask who reads them. Six requests cover most of it, and each one is an email rather than a project.

• Ask for the log retention period on your identity platform, your firewall and your endpoint tool, in days.
• Ask which of those three retain less than twelve months, and what it would cost to archive the rest.
• Ask for last quarter's access review as a scheduled export, with a reviewer's name and a date on it.
• Ask who reads the monthly output, by name, and what happened the last time it showed something.
• Ask for the exact dates of your provider's own observation period, if it holds a SOC 2 Type 2 report.
• Ask that the cadence and the named reader both go into the service agreement, not an email thread.

Two fairness notes keep this honest. A provider who has never sent these reports is not negligent, because almost no buyer asks and most of the data is one setting away. And nobody can hand you the whole file, since your vendor reviews, your exception decisions and your training records sit on your side of the line.

Read this beside the audit evidence an auditor asks for that nobody collects for the records themselves, is SOC 2 a certification? for how to read a provider's report, and control ownership for who operates which half of a shared control.

No cadence makes an assessment certain, and no honest provider promises a pass. Continuous compliance just moves the work from memory onto a schedule. Turn the controls that emit nothing into scheduled jobs, name the person who reads each one, and six weeks of annual panic becomes an export.

FAQ

What is continuous compliance?

Continuous compliance means a control produces dated evidence as it operates, rather than being reconstructed before an assessment. ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system, and the HIPAA Security Rule asks covered entities to review and modify the security measures implemented under this subpart as needed.

Is there a minimum observation period for a SOC 2 Type 2 report?

No mandatory minimum exists, but the AICPA guide does name a figure, and it is not the one you have heard. It works through an examination covering a period of less than two months and tells the auditor to consider whether such a report will be useful to users of the report, particularly where controls run monthly or quarterly. That is a usefulness prompt, not a validity rule, and the widely repeated three month floor is neither. A Type 2 report covering three months and one covering twelve carry the same label, so read the dates.

How long do Microsoft 365 and Entra ID keep the logs an auditor asks for?

Entra ID Free retains audit logs and sign-ins for Seven days, and P1 and P2 for 30 days. Microsoft 365 audit records under Audit (Standard) changed from 90 days to 180 days. Retention changes are not retroactive, so expired data can't be recovered unless it was previously archived.

Does any regulation actually require continuous monitoring?

The FTC Safeguards Rule comes closest. Monitoring shall include continuous monitoring or periodic penetration testing and vulnerability assessments, and absent effective continuous monitoring a firm must run annual penetration testing plus vulnerability assessments at least every six months. The periodic schedule is the fallback option.

How often does a CMMC assessment have to be repeated?

A Level 2 certification assessment must be completed within three years of the CMMC Status Date, with affirmation at the time of each assessment, and annually thereafter. A senior official has to affirm continuing compliance, and a conditional status requires closeout within 180 days of the CMMC Status Date.

← All Blogs