Running compliance at Meridian Bank as continuous operations, under SOC 2, ISO 27001, PCI DSS and privacy law at once. On the left, 61, 114, 251 and 43 obligations from the four regimes merge into one register of 469 obligations met by 140 controls, with multi-factor authentication satisfying all four. In the centre, an eight-step assurance staircase climbs toward an attestation seal: obligations, scope with 29 systems in and every exclusion justified, controls, implementation with 70 live, 30 partial and 40 planned, automated evidence, hourly monitoring, honest self-assessment and reporting. On the right, a continuous test catches a new unencrypted reporting database, alerts its owner as CFAIL-118, an exception is logged with an owner and a 90-day expiry, and the line of sight runs from obligation PCI 8.4 to the MFA control to 90 evidence items.

CY-MID-011Mid Level · Compliance Management

Compliance Operations — The Assurance Staircase

A mid-level course that runs a security compliance program as continuous operations, not an annual scramble. Climb the assurance staircase — Obligations, Scope, Controls, Implement, Evidence, Monitor, Assess, Report — building an unbroken line of sight from each requirement to the evidence that proves a control genuinely operates, with real work across obligation registers and OSCAL, control mapping, automated evidence collection, continuous control testing, and attestation reporting. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build a living obligation register and a defined, minimized, agreed scope.
Map obligations to a control library where one control satisfies many, without duplication.
Build an automated evidence engine and monitor controls continuously.
Self-assess honestly, get audit-ready, and attest only to what the evidence defends.

Price:৳8,000