Continuous control monitoring

Show unknown and stale states instead of assuming that missing evidence passes.

What the baseline contains

15 structured records from P10_Audit_Ops. The source workbook is a historical portfolio model, not verified operational evidence.

What is implemented

A scheduled GitHub Actions workflow collects repository alerts, creates a sanitized snapshot and publishes it as a workflow artifact. Cloudflare deployment is optional and credential-scoped.

Inspect the engineering

.github/workflows/ccm.yml and engine/ingest.py in the downloadable repository package. Open the executive observatory to inspect the modeled risk register and current technical snapshot.

Decision boundary

Scheduling is best effort. A failed API call is unknown; a failed deployment leaves the previous version online. No raw alert details or credentials enter the public report.

Review procedure

1. Establish system scope, owner, observation period and evidence provenance.
2. Execute the applicable check and inspect unknown, stale or failed results.
3. Record an evidence-linked finding, assign a treatment owner and set a review date.
4. Retest with new evidence. Keep the earlier snapshot and the reviewer’s conclusion.