Techniques for dynamic compliance monitoring and analysis

A non-transitory computer readable medium having stored thereon instructions for dynamic monitoring of compliance of practices of an organization with an organization policy, the instructions when executed by one or more processors, cause the one or more processors to:

• parse, via a policy language model, an organization policy document to determine a definitive statement that includes a natural language description of a practice that, when performed by the organization, satisfies compliance with a control of the organization policy;
• generate, via a query model, a search query used to query a datastore of heterogenous evidence data for a group of evidence data that includes indicators of whether the organization performs the practice described in the definitive statement, wherein query language guidelines of the query model instruct the query model to generate the search query such that the search query does not rely on any schema of the datastore;
• execute, via the query model, the search query to identify the group of evidence data;
• generate, via the query model, a compliance query to query the group of evidence data, wherein the compliance query is a context-based query that is unique to the group of evidence data and the definitive statement, and wherein the compliance query is agnostic to any schema of the datastore;
• execute, via the query model, the compliance query on the group of evidence data to detect whether the evidence data indicates that the organization performs the practice described in the definitive statement;
• when the evidence data indicates that the organization performs the practice described in the definitive statement, report a compliance status of the organization as compliant with the definitive statement of the organization policy;
• and
• when the evidence data does not indicate that the organization performs the practice described in the definitive statement, report the compliance status of the organization as noncompliant with the definitive statement of the organization policy.

A system for dynamic monitoring of compliance of practices of an organization with an organization policy, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, cause the system to:
• parse, via a policy language model, an organization policy document to determine a definitive statement that includes a natural language description of a practice that, when performed by the organization, satisfies compliance with a control of the organization policy;
• generate, via a query model, a search query used to query a datastore of heterogenous evidence data for a group of evidence data that includes indicators of whether the organization performs the practice described in the definitive statement, wherein query language guidelines of the query model instruct the query model to generate the search query such that the search query does not rely on any schema of the datastore;
• execute, via the query model, the search query to identify the group of evidence data;
• generate, via the query model, a compliance query to query the group of evidence data, wherein the compliance query is a context-based query that is unique to the group of evidence data and the definitive statement, and wherein the compliance query is agnostic to any schema of the datastore;
• execute, via the query model, the compliance query on the group of evidence data to detect whether the evidence data indicates that the organization performs the practice described in the definitive statement;
• when the evidence data indicates that the organization performs the practice described in the definitive statement, report a compliance status of the organization as compliant with the definitive statement of the organization policy;
• and
• when the evidence data does not indicate that the organization performs the practice described in the definitive statement, report the compliance status of the organization as noncompliant with the definitive statement of the organization policy.