From periodic certification
to continuously verified trust.

The important question is not only whether a system passed its last assessment. It is whether its controls still hold after the next change.

The gap between assessed and actual state

Infrastructure defined in code can change many times between assessments. Ephemeral resources disappear. Shared responsibilities vary by service. A static evidence package cannot, by itself, describe every subsequent state.

Make the control catalog the center of gravity

Jim’s paper starts with a unified catalog: requirements mapped across applicable frameworks, each with a named owner and a clear definition of acceptable evidence. The catalog gives technical policy and human workflows a shared purpose.

Connect prevention, observation, and action

Policy as code can prevent some noncompliant changes before deployment. Runtime evaluation catches changes outside that path. Findings then enter a governed response process, rather than accumulating in a separate queue with no accountable owner.

Evidence should follow the work

Operational evidence belongs in a shared platform of record. Structured formats such as OSCAL can help exchange that information, but the receiving assessor still needs to agree on what evidence is sufficient.

Be honest about what cannot be automated

Training, policy review, personnel processes, and other administrative controls need workflow-driven evidence. Automation should not obscure missing evidence, imperfect mappings, or the judgment an assessor must exercise.

Start narrow and prove value

Choose one system and a high-value control set. Measure assessment effort, findings, evidence coverage, and remediation time. Expand from what the pilot demonstrates.