Third party security audits and certifications are traditionally performed annually or bi-annually, which means that whenever interim changes are made to security and privacy practices, the change and effectiveness of these amendments are not evaluated by the assessors until the next official check. The EU-SEC project has developed a process that allows continuous assurance by addressing the lack of regularity and proactivity of traditional “point-in-time” certifications. Continuous auditing based certification completes the Level 3 of the Open Certification Framework and builds upon the STAR Level 1 and Level 2. By using technology to monitor and flag non-compliant activity on an ongoing basis, continuous auditing delivers an enhancement to traditional certification. It increases the assessment frequency via a continuous workflow. State of the art security monitoring systems supervise the organization’s security status by collecting data from the CSP’s information system. This collected data is further assessed and normalized making assessments unambiguous, repeatable and comparable across different information systems.