Controls checked continuously, not annually.
Run automated technical rules against the data RiskVantis already collects from Microsoft Entra ID, Microsoft 365, your assets and privacy records. Start from a rule library mapped to SCF controls, build rules visually or write your own.
| Target | Rule | Control | Result |
|---|---|---|---|
| Conditional Access | MFA required for admins | SCF IAC-06 | Pass |
| app-hr-sync | Secret expires < 90 days | SCF IAC-10 | Fail |
| st-archive | Storage blocks public access | SCF NET-04 | Pass |
| vm-legacy-02 | Disk encryption enabled | SCF CRY-05 | Unknown |
| SharePoint | External sharing restricted | SCF DCH-13 | Pass |
Illustration with sample data
What Policy-as-Code & Continuous Monitoring does
Policy-as-Code turns technical control requirements into rules evaluated by an embedded policy engine. A rule library offers framework-neutral checks mapped to canonical controls, so one rule covers every framework those controls reach, including ISO/IEC 27001, PCI DSS, HIPAA, GDPR and ISO/IEC 42001. The Visual Rule Builder creates rules from a registry of entities, fields and operators, and advanced users can write Rego directly.
A data source binds a rule to collected data. It runs on a schedule or after each connector sync and records PASS, FAIL, NOT APPLICABLE or UNKNOWN for every target, with the exact input it saw. Missing data is Unknown, never Pass. Try on Real Data previews a rule before it is activated, and an optional approval step keeps the author from approving their own rule. Results can open findings and record evidence, and each control shows an honest monitoring label.
Key capabilities
Rule library
Framework-neutral checks mapped to SCF controls, with samples tested on every release.
Visual rule builder
Build rules from entities, fields and operators, with no code required.
Advanced Rego
Write custom rules for anything the builder doesn't cover.
Live data sources
Microsoft Entra ID, Microsoft 365, assets and privacy processing activities.
Honest results
PASS / FAIL / NOT APPLICABLE / UNKNOWN per target; missing data is never a pass.
Findings & evidence
Optional findings after repeated failures, and run summaries filed as evidence.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Policy-as-Code & Continuous Monitoring changes for your programme.
Less manual control testing
Automated checks replace screenshot-based testing for technical controls.
Framework-neutral
Rules map to canonical controls and cover every framework they reach.
Operating effectiveness
Every run is recorded with its inputs, which supports Type II-style testing.
Between audits
Failures surface as they happen, not at the next audit.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Pick or build a rule
From the library, the visual builder or Rego.
Preview on real data
Try the rule before activation.
Bind a data source
Choose the targets and the schedule.
Monitor
Results, findings and evidence flow automatically.
Supports your obligations.
Policy-as-Code & Continuous Monitoring contributes evidence and coverage to these frameworks and regulations.
Common questions.
Does a PASS mean we are compliant?
No. A pass is a machine check that feeds the control's status alongside tests, evidence and applicability. It is never a compliance claim on its own.
Do runs call vendor APIs directly?
No. Rules evaluate data RiskVantis has already synced, and every result records what was actually collected.
Can I write my own rules?
Yes. Use the Visual Rule Builder or write Rego. An optional approval step keeps authors from approving their own rules.
Works better together.
Control Register, Testing & RACI
One register for your own controls, with versioned definitions, scoped RACI, assurance tests that count only after independent review, evidence requirements with…
Learn more →Compliance ManagementEnterprise Compliance Posture
Compliance status in RiskVantis is calculated, never typed in. Every requirement, in every organisation, shows its status, why it has that status and what would change…
Learn more →Platform, Security & IntegrationsIntegrations & API
Connect Microsoft Azure, Entra ID and Microsoft 365 for inventory, identities and continuous checks. Receive findings from other systems, and connect your SIEM or…
Learn more →See Policy-as-Code & Continuous Monitoring in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.