Automated Control Assessments

What is an automated control assessment?

Automated control assessment tests each control against live system state on a set frequency, instead of asking its owner to attest to it once a year. DigitalXForce runs these assessments in the AI-Powered Risk Management and Automated GRC module. Automated GRC replaces spreadsheet governance, risk and compliance with a platform that tests controls, maps them to frameworks and reports status without manual evidence collection. The point in time testing page compares the two approaches.

What is the difference between C-Assess and X-Assess?

C-Assess tests controls against each framework’s requirements. X-Assess tests security controls against the live state of the security stack. Both are assessment types in the DigitalXForce Automated GRC module, along with A-Assess for audit. Each tested control is mapped to every framework requirement it satisfies across 50+ compliance frameworks, and the frameworks page shows the most requested ones.

How often does DigitalXForce test a control?

Each control in DigitalXForce has its own test frequency, set by how fast its evidence can change. The Continuous Control Monitoring page gives examples: MFA status is read daily, log retention and SIEM feed health hourly, backup verification daily and policy acknowledgment monthly. Some controls, such as a board’s review of risk appetite, leave no machine-readable trace, so they carry a review date instead of a test frequency.

What does DigitalXForce store with each assessment result?

Every test result in DigitalXForce is stored with the evidence it read and a timestamp. DigitalXForce keeps every result, exception, decision and retest, so an auditor sees the history of a control instead of a sample. The evidence collection page shows how that evidence is gathered.

What happens when a control fails an assessment?

A failed control in DigitalXForce opens a finding with an owner and a due date. A single failed result shows up in the compliance view, the posture view and the risk register at once. The control is tested again when the fix is marked done, and the finding closes only when the retest passes. If the organization accepts the gap instead, a named person records the decision with a reason and an expiry date.

What is an assurance gap?

An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. DigitalXForce records stale or missing evidence as stale or missing and never counts it as a pass. Because the compliance dashboards show evidence age, an assurance gap stays visible.

How does Continuous Control Monitoring fit with Continuous Control Assurance?

Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within Continuous Control Assurance, which sits above it as the strategic level. In DigitalXForce, CCM reads evidence between tests, and Continuous Control Assurance uses that evidence to judge whether each control still works.

Do automated control assessments replace audits?

Automated control assessments do not replace audits, since external audits, certifications and internal audit still run on their own cycles. DigitalXForce does not perform internal audits. Auditors can review the control history in the platform, and each auditor decides whether to rely on that history.