# Continuous Control Testing

CA-7 continuous monitoring intent, finding ownership, and the distinction between a single pass and continuing effectiveness.

- CA-7 continuous monitoring tests whether a control keeps operating over time, not just whether it passed once.
- A control-testing finding carries a named owner and a due date; it is opened, not silently fixed, especially for a high-risk production failure.
- A single passing observation is not proof of continuing operating effectiveness; the tested population and period must be reported alongside the result.

## Sources

- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- https://www.nist.gov/cyberframework
- https://owasp.org/www-project-top-10-for-large-language-model-applications/