What it means
Continuous control monitoring checks that controls are operating as designed on a recurring automated basis, rather than through periodic sampling. The intent is to shorten the gap between a control failing and somebody knowing.
It is often bought as a technology and lost as an operating discipline: the monitoring runs, exceptions are generated, and nobody owns the queue.
Where MyRISK fits
What we do about it
MyRISK has published a longer piece on where CCM programmes succeed and fail, which is the better starting point than a definition. Core is the product side of it: one held record of controls and evidence, which is what monitoring needs to monitor against.
Is this the thing you are actually trying to fix?
A definition rarely settles it. Tell us what happened — the request, the finding, the challenge or the incident — and we will say where to start, or that it isn't us.