Compliance automation is software that checks a company's security controls every hour, collects the evidence automatically, and shows an auditor a live dashboard. It is also called continuous control monitoring. Companies use it mainly to pass security audits such as SOC 2 and ISO 27001.
SOC 2 is an audit report, written by an independent auditor, on how a company protects its customers' data. It is a standard from the United States, and customers there ask for it most often. ISO 27001 is an international standard for running information security. A company that meets it receives a certificate. Many Indian software companies need one of these before a large customer will sign a contract.
An audit checks controls. A control is a rule that the company says it follows. For example: "every laptop's disk is encrypted", "every employee who leaves loses access the same day" and "every change to the code is reviewed by a second engineer". Ten years ago, an employee proved these by hand. The employee took hundreds of screenshots over six months and saved them in a shared folder for the auditor.
Compliance automation connects to the company's systems instead. It reads the cloud settings, often through a cloud security posture management (CSPM) tool. It reads the code repository to see whether each change was reviewed. It reads the HR system to see who joined and who left. And it reads the device management tool to see whether each laptop is encrypted.
Consider an 80-person software start-up in Coimbatore that sells a scheduling app to clinics in Australia. Its first large customer asks for an ISO 27001 certificate. The tool connects to the start-up's systems and finds 112 controls to track. On the first day, 19 of them fail. For instance, 6 laptops have no disk encryption, and 3 former employees still have accounts. The team fixes these over three weeks. After that, the tool checks every control every hour. When a new laptop arrives unencrypted, the tool raises an alert the same day, not at the next audit.
The tool also tracks the human controls, such as whether each employee has finished security awareness training. When the auditor arrives, the evidence is already collected, with dates.
Compliance automation proves one company's own controls. A GRC platform is larger. It holds a big organisation's risks, policies and suppliers, across many departments. Customers often send a long security questionnaire as well. Answering it is the job of security questionnaire automation.