Fee
Register to see indicative feesConfirmed in writing after scoping01 / Ongoing · Supporting
Continuous Compliance
You achieved the certification, and eleven months later nobody is sure the evidence still exists.
Assurance & ComplianceOngoing
Typical duration
OngoingMonth to month, 30 days' notice either wayPrimary artefact
Monitored control set with a quarterly evidence cyclePlus one moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Continuous Compliance is
An ongoing arrangement that keeps a certified or assessed position current between audits: evidence collected on a cycle, control drift surfaced, and the surveillance audit prepared for rather than scrambled at.
And what this service produces
It is month to month with 30 days' notice. We would rather earn the renewal than hold you to a term.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- You are certified to ISO 27001 or similar with no ongoing evidence discipline.
- Compliance work spikes before every audit.
- You run multiple frameworks with overlapping evidence needs.
02
The usual trigger
- A surveillance audit is approaching and evidence is scattered.
- Certification was achieved and the ISMS has gone quiet.
- Compliance effort spikes annually and nobody owns it in between.
06 / The obligation
Why certified organisations fail surveillance audits
Certification is a point-in-time judgement about a system that is supposed to keep running. The common failure is not that controls stop working; it is that the evidence that they worked stops being collected.
The assurance activities slip
Internal audit does not happen. Management review slips a quarter. Access reviews are performed but not recorded.
Operating without evidence
Twelve months later the controls may well be operating, and there is nothing to demonstrate it with, which from an auditor's position is the same thing.
A cycle, an owner and a place for the evidence
The fix is unglamorous: a cycle, an owner, and a place the evidence goes. It is not complicated work, which is exactly why it gets deprioritised until three weeks before the audit.
Controls rarely stop working. The evidence that they worked stops being collected, and to an auditor those are indistinguishable.
07 / What you receive
Two artefacts. Each one yours to keep.
- 01
Quarterly evidence cycle
Evidence collected, reviewed and filed against each control, on a schedule.
Evidence repositoryISMS owner - 02
Drift and exception reporting
Controls that have stopped operating, surfaced when it happens rather than at audit.
Quarterly reportSecurity leadership
08 / Scope
The whole system is visible before work begins.
Evidence cycle
- Evidence requirements mapped per control
- Quarterly collection and review
- Repository maintained and audit-ready
Assurance activities
- Internal audit programme run
- Management review facilitated
- Corrective actions tracked
Drift monitoring
- Control operation reviewed quarterly
- Exceptions raised and tracked
- Change impact assessed
Audit support
- Surveillance audit preparation
- Auditor liaison
- Finding management
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- A quarterly evidence cycle against each control
- Internal audit, management review and corrective action tracking
- Control drift monitoring and exception reporting
- Surveillance audit preparation and support
Not included
- Control operation: Your team operates the controls. We maintain the evidence discipline around them.
- Security monitoring: This is not a SOC. We do not monitor your environment.
- Remediation: Where drift requires fixing, that is your team or separate work.
- Certification: Accredited certification bodies certify.
10 / How we do it
A traceable path from scope to evidence.
Onboarding
Evidence requirements mapped, repository established, cycle agreed.
Quarterly cycle
Collection, review, drift reporting and corrective action tracking.
Annual assurance
Internal audit and management review run within the cycle.
Audit support
Surveillance audit preparation and liaison.
Mapped againstISO/IEC 27001NIST Cybersecurity FrameworkEssential Eight (Australia)
11 / Timeline
Ongoing of work.
Elapsed time and customer effort are separated because they are not the same number.
Monthly
What happens every month
Evidence collection prompts, exception tracking, and a short status note.
Customer effort
Roughly two hours of your team's time.
Quarterly
What happens every quarter
Evidence review, drift report, and corrective action check.
Customer effort
One 60-minute session with the ISMS owner.
Annually
What happens each year
Internal audit run, management review facilitated, and the surveillance audit prepared for and attended.
Customer effort
Management review and the surveillance audit.
Exit
How it ends
Month to month, 30 days' notice either way. No exit fee and no data held hostage.
Customer effort
The evidence repository and the cycle documentation are yours and stay with you.
Our work: Ongoing
12 / Scope check
Test whether Continuous Compliance
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your continuous compliance lead
Steve Sharma
Founder & Principal
Runs the quarterly review and attends the surveillance audit.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
Month to month, and we say so first.
No minimum term, 30 days' notice, no exit fee. We would rather earn the renewal than hold you to a contract.
The repository is yours from day one.
Everything we build lives in your systems. If you leave, nothing goes with us.
Unglamorous by design.
A cycle, an owner and a place the evidence goes. It is not complicated; it is just consistently deprioritised, which is the whole problem.
15 / The boundary
What this engagement does not claim.
Operations
We maintain evidence discipline. Your team operates the controls.
The evidence repository lives in your systems and stays with you if the arrangement ends.
Monitoring
We are not a managed security service.
We do not monitor your environment and we do not run a SOC.
Certification
We prepare for surveillance audits. We do not certify our own work.
We prepare organisations for assessment and certification, but we do not certify our own work. Accredited certification bodies certify.
Frameworks
One evidence cycle, mapped across three references.
The work maps to ISO/IEC 27001, the NIST Cybersecurity Framework and, for Australian organisations, the Essential Eight.
What moves the fee
Per additional framework in scope.
Where the Statement of Applicability is unusually broad.
Where evidence is already system-generated.
Monthly fee, month to month30 days' notice either wayNo minimum termNo exit fee
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
You are not certified or assessed against anything.
There is nothing to keep current yet. Start with readiness.
02
You have a functioning internal compliance function.
You probably do not need us, and we would rather say so.
03
You want your environment monitored.
We are not a SOC and we will point you to one.
20 / FAQ
The questions that change the decision.
No. Month to month, 30 days' notice either way, no exit fee. If we are not adding value you should be able to stop, and making that easy is deliberate.
It stays with you. The repository lives in your systems and the cycle documentation is yours. Nothing goes with us and there is nothing to hand back.
No. We are not a SOC and this is not security monitoring. We maintain the evidence that your controls operated, which is a different thing.
Often, yes, and if you have a functioning internal compliance function you probably should. This exists for organisations where the work is real but does not justify a dedicated hire.
21 / Next move
If Continuous Compliance is what you need, the next step is a conversation about scope.
A 45-minute conversation about what your scope actually looks like, what it would cost, and whether this is the right service for you at all. With Steve Sharma, who would lead the engagement.