In this article 11 sections
You watch every client’s systems, and nobody checks yours.
Continuous assurance is the ongoing verification that your security controls are still in place and working correctly between formal audits. A point-in-time audit proves your controls were sound on the day they were checked. Continuous assurance keeps checking after that day, so the proof stays current instead of expiring quietly the moment the auditor packs up.
For a UK MSP, that gap between “we passed” and “we’re still secure today” is where most of the real risk lives. You can hold a valid certificate and still have a lapsed backup, an offboarded admin who kept their access, or an MFA policy someone switched off for a noisy client 3 months ago.
What is continuous assurance?
Continuous assurance is a model where an independent standard is checked repeatedly over time rather than once a year. Instead of a single pass or fail on audit day, controls are monitored on an ongoing basis and flagged when they drift out of compliance.
The idea comes from audit and risk practice, where “assurance” means evidence that something is true and will keep being true. Continuous assurance applies that same evidence standard on a rolling basis.
Three things make it continuous:
- Controls are checked on a recurring schedule, including between renewals.
- Drift is caught between audits, when a control that passed later stops working.
- The status is current, so anyone relying on it sees today’s position rather than last year’s.
Why does a point-in-time audit stop being true the day after?
An audit is a snapshot. It captures how your controls looked at one moment, under conditions you had time to prepare for.
Security doesn’t hold still after that moment. Staff leave. Tools update. A client asks for an exception “just this once.” Each change can quietly undo a control that passed cleanly a week earlier.
Here’s the uncomfortable part: nothing tells you when it happens. The certificate reads the same whether your controls work or not.
That’s the core problem continuous assurance is built to solve. It shortens the distance between “a control broke” and “someone knows about it” from 12 months to days.
Continuous assurance vs point-in-time audit, side by side
Both have a place. A formal audit sets the bar. Continuous assurance keeps you above it. The difference shows up clearly once you lay them next to each other.
| Dimension | Point-in-time audit | Continuous assurance |
|---|---|---|
| What it checks | Your controls as they looked on audit day | Whether those controls are still working now |
| How often | Once per cycle, usually annually | On a recurring schedule, all year |
| What a gap looks like | Invisible until the next audit | Flagged when it happens, with an owner and a deadline |
| What the client sees | A certificate dated months ago | A live, monitored status they can rely on today |
What does continuous assurance actually check?
It checks that specific controls are still doing their job in practice, beyond policies written on paper.
Typical checks include:
- Multi-factor authentication is enforced across privileged accounts and can’t be bypassed.
- Backups ran, completed, and can be restored.
- Leavers lost access on their last day.
- Patching is current on the systems that matter.
- Logging and monitoring are switched on and producing data.
- Admin access is limited to the people who still need it.
Frameworks describe what good looks like. Continuous assurance confirms good is still happening.
Why continuous assurance matters more for MSPs
An MSP is a single point of failure for every client it serves. One weak control in your stack becomes a risk multiplied across your whole book.
Regulators know this. A finance firm under FCA expectations, a business inside NIS2 scope, a company facing DORA, all of them are being told to check their suppliers, and you are the supplier.
When a questionnaire from a client’s insurer or bigger customer asks how you know you’re secure, a year-old certificate is a weak answer. “We’re independently assessed and monitored on an ongoing basis” is a strong one. (This is exactly the ground you want to be standing on in a client security review that wins the renewal.)
How does continuous assurance work in a real trustmark?
The Assurix Trustmark is a working example, so it’s worth walking through the mechanics.
The Trustmark is an independently assessed, evidence-based trustmark for UK MSPs. Assurix independently assesses 59 controls: 40 security controls aligned to the NCSC Cyber Assessment Framework (CAF) 4.0 and 19 operational controls built for MSPs. Both pillars must pass. There’s no half Trustmark and no “mostly compliant.” The result sits on a Trust Portal anyone can open.
Here’s the part that keeps it current:
- If a control fails, you get a 30-day remediation window to fix it.
- If it isn’t fixed inside that window, the result is public suspension of the Trustmark.
- Live-measured controls are checked every six hours and the rest on a set cycle, so a live-measured control that breaks in month 4 is caught within hours, not at next year’s review.
Ian Groves at Start Tech: “It isn’t do or die… There is a proper process around this, and there is opportunity to rectify anything.”
The scope is the MSP itself, so it assesses your own security posture and the service you run, not each client’s environment. Passing means an Assurix assessor has independently signed off your controls, and the checks keep running.
A certificate proves a date. Assurix proves today.
That line is the whole point. ISO 27001, Cyber Essentials, Cyber Essentials Plus and IASME assessments are valuable, and most of them are point-in-time by design. They confirm you did the work. Continuous assurance confirms the work is still standing. Proof, not promises.
What does continuous assurance look like day to day?
For most MSPs it runs quietly in the background and only speaks up when something needs attention. Here’s the shape of it in practice.
Continuous assurance in practice: a checklist
- Controls are mapped to a named standard (for the Trustmark’s security controls, NCSC CAF 4.0).
- Each control has an owner and an expected working state.
- Checks run on a schedule, including between audits.
- Drift raises a flag with a clear owner and a deadline.
- A remediation window (30 days for the Trustmark) is agreed up front.
- Failure to remediate has a real consequence (public suspension).
- Status is visible and current to anyone who relies on it.
- An independent assessment still anchors the whole thing.
If you can tick most of that list, you’re running continuous assurance whether you call it that or not. If you can’t, the gaps on that list are usually where the next surprise comes from.
How do you explain continuous assurance to a client?
Keep it concrete.
Try this: “A certificate tells you we passed a test last year. Continuous assurance means we’re checked all year, and if something slips, it gets caught and fixed on a clock.”
Then make it their problem, gently. Ask how they’d know today if one of their suppliers had quietly fallen out of compliance. Most can’t answer. That’s the value you’re offering: an answer they can trust without taking your word for it.
Continuous assurance in regulated sectors
Regulated clients raise the stakes. Under NIS2, DORA and FCA operational-resilience expectations, businesses are accountable for the security of their supply chain, and that accountability doesn’t pause between audits.
For an MSP chasing finance, legal, healthcare or other regulated work, ongoing verification changes what you can credibly claim. You can show a live, independently monitored status instead of a stale PDF. That difference wins deals a one-time certificate can’t, which is the core of winning MSP deals in regulated sectors.
What do people get wrong about continuous assurance?
A few myths worth clearing up.
It replaces audits. It doesn’t. The independent audit still sets the bar. Continuous monitoring keeps you honest between those audits. For the Trustmark, an Assurix assessor signs off, and live-measured controls are checked every six hours and the rest on a set cycle. Both parts do a job.
It’s just automated alerts. Alerts are part of it, though assurance means an independent standard, agreed remediation, and real consequences for ignoring a failure. Noise without accountability isn’t assurance.
It covers your clients. For the Trustmark, the scope is your MSP. It assesses your own systems and service, which is what clients trust you with.
It’s the same as ISO or Cyber Essentials. Those confirm work done at a point in time. Continuous assurance confirms that work is still being maintained today. You can hold both, and they answer different questions.
Frequently asked questions
Is continuous assurance the same as continuous monitoring?
They overlap. Continuous monitoring is the tooling that watches controls. Continuous assurance is the wider model that adds an independent standard, defined remediation, and a consequence for failing to act. Monitoring feeds assurance.
Does continuous assurance replace ISO 27001 or Cyber Essentials?
No. Those set recognised standards and remain worth holding. ISO or Cyber Essentials shows work done at a point in time, and continuous assurance proves that work is still being maintained today. They sit together.
How often are controls checked under continuous assurance?
It varies by control. The point is that checks run on a recurring basis rather than once at audit time. For the Assurix Trustmark, live-measured controls are checked every six hours and the rest on a set cycle, so drift in a live-measured control is caught within hours.
What happens when a control fails?
Under the Trustmark, a failed control opens a 30-day remediation window. Fix it inside the window and your status holds. Miss it and the Trustmark is publicly suspended, so the Trustmark always reflects reality.
Does the Assurix Trustmark cover my clients’ security too?
No. The Trustmark’s scope is the MSP itself. Its 40 security controls cover your own systems, aligned to NCSC CAF 4.0. Its operational controls cover the service you deliver, such as SLA, CSAT and patching. Per-client views are planned.
How do I find out if I’d pass today?
Score your MSP against the Premium MSP Differentiation Checklist to see where your gaps are before a formal assessment does.
Closing that gap by hand, mapping every control, scoring it, monitoring it and chasing the fixes, is a real job on top of running your MSP. With Assurix you put in from 2 hours a week, with a named customer success person. Live-measured controls are checked every six hours and the rest on a set cycle, and anyone can check the result.
