Continuous control monitoring
Quick answer
Automate control testing with indicators, templates and results that feed compliance and audit.
Key takeaways
- Indicators turn control testing into scheduled automation
- Templates scale one definition across many entities
- Failures must create owned issues to be worth running
- Keep versions so historical results remain explainable
What continuous monitoring does
Instead of asking a person whether a control operates, an indicator queries the platform or an integrated system on a schedule and records a pass or fail with the evidence. Compliance moves from point in time to ongoing.
Indicator templates
Templates let one definition apply to many controls. For example, a template that checks whether privileged accounts were reviewed in the last 90 days can apply to every in scope system, generating results per entity.
Designing good checks
A check is only useful when a failure is actionable.
- State the exact condition that constitutes a pass
- Sample rather than test everything when volume is huge
- Fail loudly, create an issue with an owner
- Version the check so an auditor can see what was tested last quarter
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
What lets one check apply to many entities?
- A. An indicator template
- B. A dashboard
- C. A workflow
- D. An ACL
Show answer
A. An indicator template
Templates generate indicators per applicable entity.
A failed continuous check should
- A. Send an email only
- B. Create an owned issue
- C. Update the policy
- D. Close the control
Show answer
B. Create an owned issue
Issues carry owner, date and remediation tracking.