Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
54 results for “Continuous Controls Monitoring”
Control Test Automation
Executing a control's test continuously against the whole population rather than sampling it annually, which changes both the detection latency and the strength of the evidence.
Application Performance Monitoring
Instrumentation inside the application that attributes latency and errors to specific code paths, queries and dependencies.
Continuous Compliance
Producing compliance evidence automatically and continuously from the systems themselves, rather than reconstructing it before an audit.
Continuous Profiling
Sampling CPU, memory and lock profiles from production continuously at low overhead, so resource usage can be attributed to specific code paths.
Etsy's Continuous Deployment
Etsy moved from infrequent, risky releases to dozens of deploys a day, demonstrating that deployment frequency and stability improve together rather than trading off.
Synthetic Monitoring
Continuously executing a real user journey against production from outside it, so a broken journey is detected before a user reports it.
APM Transaction Tracing
Instrumentation that attributes application latency and errors to specific code paths, database queries and external calls, usually with automatic tracing.
Branch Lifetime
How long a branch lives before being merged, which determines integration pain and is the practical measure of whether integration is continuous.
Burn Rate Alerting
Paging when the error budget is being consumed fast enough to matter, rather than when a component crosses a threshold.
CI/CD
Merging work continuously into a shared trunk with automated verification, and keeping every commit in a state that could be released.
Cardinality
The number of distinct time series produced by a metric, which is the product of the distinct values of all its labels — and the main driver of monitoring cost.
Compliance Framework
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
Encryption at Rest and in Transit
Protecting stored data from disclosure if the medium is obtained, and network data from disclosure if the path is observed — two different controls against two different threats.
Fairness Definition Choice
Selecting which mathematical fairness criterion applies, given that the main criteria are provably incompatible and the choice is a value judgement.
Field Data Versus Lab Data
The difference between what real users on real devices experience and what a synthetic run measures, and why the second is systematically optimistic.
Golden Signals
The four measurements that cover most of what matters for a request-driven service: latency, traffic, errors and saturation.
Governance Operating Model
The arrangement of decision rights, review points and automated controls through which architectural intent is maintained across an organisation.
Integration Frequency
How often each engineer merges to the mainline — the measurement that distinguishes continuous integration from having a CI server.
Learning Debt
The accumulating gap between an architect's knowledge and the current state of the field, which compounds silently because nothing forces its repayment.
Log-Based Ingestion
Building the pipeline around a database's own change log — an initial snapshot followed by a continuous delta stream, with the two stitched together.
Metric Cardinality
The number of unique label-value combinations on a metric, which multiplies into the number of time series stored and is the primary driver of monitoring cost and failure.
Netflix Open Connect
Netflix built its own CDN and placed appliances inside ISP networks, turning the most expensive part of its cost structure into hardware it controls.
Observability
The property of being able to answer new questions about a system's internal state from its external outputs, without shipping new code.
Operator Independence
The requirement that no foreign entity can be compelled to access or disclose data, which goes beyond where the bytes are stored to who controls the operator.
Pipeline Anomaly Detection
Monitoring row counts, distributions, freshness and schema for unexplained change, because data pipelines fail silently far more often than they error.
Prime Video's Move Back to a Monolith
Amazon Prime Video consolidated a serverless, distributed audio/video monitoring service into a single process and reported a 90% cost reduction — the most-cited example of micros…
Privacy by Design
Building privacy protections into a system's structure from the start, rather than adding controls to a design that already collects and keeps everything.
RED Method
A minimal per-service dashboard: Rate, Errors, Duration — the request-centric view of whether users are being served.
Replication Lag
How far behind a replica is, measured in time or in log position — the quantity that determines how stale a replica read can be.
Standard Change
A pre-authorised class of change whose risk controls are automated and evidenced, so it does not need per-instance approval.
USE Method
For every resource, track Utilisation, Saturation and Errors — the resource-centric complement to request-centric monitoring.
Quarterly access reviews take two weeks of manager time and everyone approves everything. How do you make this a real control?
Recognise what it currently is A review where everything is approved is not producing a decision; it is producing a record of a decision shaped activity. Two we
A single deploy took down your monitoring platform. What happened, and how do you prevent a recurrence?
What almost certainly happened A high cardinality label was added to a metric. Each unique combination of label values is a separate time series, and cost scale
Customers reported an outage 40 minutes before your monitoring did. How do you close that gap?
What the gap tells you Every technical signal was green while users were failing. That is not a threshold tuning problem; it means the system was monitoring com
A deployed model performed well in validation and its business metric has declined over four months. Nothing has been deployed. What do you investigate?
The model did not change; its world did Three distinct causes, and they need different responses: Data drift. The input distribution has moved — a new customer
A partner reports your API fails from their servers with a certificate error. It works in every browser you try and from your laptop. Diagnose and prevent.
The diagnosis An incomplete certificate chain. The server presents its own certificate but not the intermediates. Browsers frequently recover — they cache inter
A release must rename a heavily used database column and ships tonight. The team proposes doing the rename in the deployment. What is wrong, and what do you propose?
What is wrong A rename is not additive. During a rolling deployment both versions of the application run simultaneously: one expects the old name, one the new.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Change Management vs CD
Reconciling CAB-era controls with continuous delivery without pretending either away.
Application Performance Monitoring
Attributing latency to code paths, queries and dependencies.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Continuous Integration Discipline
Integrating to the mainline daily, and the test speed and review culture that requires.
Continuous Learning
Staying current without chasing every new thing.
Real User Monitoring
Field data from real devices and networks, against the synthetic run that looked fine.
SLO Monitoring
Burn-rate alerting that fires on user impact rather than on thresholds.
Architecture Governance
Preventive, automated controls rather than review meetings.
CI/CD
Continuous integration and delivery, and the architecture that caps them.
Data Observability
Freshness, volume, schema and distribution monitoring for pipelines that fail silently.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
Profiling
Continuous CPU and memory attribution in production.
Sensitivity Labelling
Propagating a classification through joins and derived tables so controls follow the data.
Streaming & Real-Time Data
General material on continuous processing of unbounded data.
Third-Party Risk
Assessing, contracting and monitoring the vendors your architecture now depends on.