Continuous Controls Monitoring

Organizations need continuous visibility into whether their security controls are operating effectively to support regulatory compliance, audit requirements, and the protection of critical information systems. However, monitoring control effectiveness can involve significant manual effort, fragmented reporting, delays in accessing data, and lengthy processes for adding new control measurements.

DataBee Continuous Controls Monitoring (CCM) simplifies this process by providing continuous, easy-to-understand insights into security control effectiveness. With flexible measurements, multi-framework reporting, customizable no-code workspaces, and an AI-native platform, DataBee CCM enables security and GRC teams to build and manage a scalable controls monitoring program that meets their organization’s needs.

With DataBee CCM, you can:

• Turn control questions into actionable insights: Continuously evaluate control effectiveness using operational data and focus on the controls and metrics relevant to cyber risk and compliance requirements.

• Build and customize your controls monitoring program: Define measurements and monitor against frameworks that support your organization’s requirements.

• Use only the data required for a measurement: DataBee retrieves the data needed for a specific measurement while the underlying data remains in its existing source system. The resulting measurement value and its history are retained for reporting and trend analysis.

• Understand and investigate results: Use built-in AI capabilities to explore control performance using natural language, understand how measurements are derived, and investigate gaps and trends.

• Support multiple reporting requirements: Reuse results across applicable frameworks to support consistent reporting without repeatedly validating and mapping the same data.

Follow the steps below to configure and use DataBee CCM.

Select Controls from the top navigation bar.

Step 1: Choose your frameworks

Choose one or more frameworks from the available list. You can:

• Select standard cybersecurity frameworks, such as NIST CSF or ODMs.

• Select Internal Security Policy to customize and create your own framework.

Click Continue to move to step 2.

Step 2: Select your Controls

If you selected multiple frameworks, select each framework individually and choose the controls you want to implement.

• Review the control descriptions, then select the appropriate controls by selecting the corresponding checkboxes.

• Click Select All to select all controls available for the selected framework.

• Click Clear to clear your selections and deselect all controls.

For Internal Security Policy, you can add controls in either of the following ways:

• Select Add new, enter the Control ID and Control description, and click Add Control. Repeat this process for each control you want to add.

Click Continue to proceed to Step 3.

Step 3: Define your metrics

A metric is a technical measurement evaluated against a configured threshold used to determine whether a control is being met or not. A control can leverage multiple metrics to determine compliance. When using more than one metric for a control, all metrics must report as met for the control to be considered in compliance. If any metric is not met (i.e., in an alert state), the control will be considered out of compliance. A control without a metric is Not Assessable and is reported as unmeasured.

Add control details (optional):

Add a brief description that explains why the control matters, the risks it addresses, the control owner, and the roles and responsibilities your team needs to follow. This information will be used by DataBee when answering questions about this control.

Add manually:

• Enter a suitable Name and Description for the metric.

• Select the Metric type, such as Percentage or Value. A percentage-typed metric consists of a ratio between a numerator and denominator. Both the numerator and denominator are considered sub-metrics. A value-typed metric consists of just a single value.

  

• Under What do you want to count, select a sub-metric from the available options. You may select from already configured sub-metrics or click Create a new sub-metric if the desired data is not yet being collected.

  

• To create a new sub-metric, click Create a new sub-metric. On the “Name your sub-metric” page, enter the Name and Description, and then click Start chat.

  

See  Building a Sub-Metric Generator with AI for additional details on this agentic user experience.

Configure the schedule:

• Click Edit Schedule.

• Select how frequently the metric should run: Daily, Weekly, Monthly, or Annually.

• Select the details on which you want the metric to run. Options vary depending on the selected frequency.

• Click Save Schedule.

  

Configure thresholds:

• Click Edit Thresholds.

• Select whether a higher or lower metric value is considered better.

• Define the threshold values below/above which a warning and an alert are triggered.

• Click Save Thresholds.

  

After entering the metric details, click Save as Draft to save your progress or Create Metric to create the metric in the system and begin collection.

After defining metrics for all controls across all selected frameworks, click Generate Baseline Report.

This takes you to the Controls Posture page. From here you can add or remove controls using Edit Controls or export the Control Portfolio using Export options.