Global Journal of Engineering and Technology Research (GJETR) · Research article · Open access
The Compliance Gap: Why Audit-Based Cybersecurity Models Fail Critical Infrastructure and the Case for Continuous Control
Chukwunenye Amadi
10 September 2026 · Vol. 2, Issue 9, pp. 536-562
DOI: 10.65150/EP-gjetr/V2E9/2026-12
Download full text (PDF)Cite this article
What is this article about?
Critical infrastructure (CI) sectors, including energy, water, transportation, healthcare, telecommunications, and finance, continue to anchor their cybersecurity assurance in periodic, audit-based compliance: scheduled assessments that certify, at a point in time, that mandated controls exist and are documented. This conceptual review argues that this model is structurally incapable of guaranteeing security in modern CI environments and develops the case for a transition to continuous monitoring and continuous control.
Article at a glance
- Published
- 10 September 2026
- Volume / issue / pages
- Vol. 2, Issue 9, pp. 536-562
- ISSN
- 3051-3782 (online) · 3051-3774 (print)
- Licence
- CC BY 4.0 — free to read and reuse with attribution
- Peer review
- Double-blind, at least two independent reviewers
- Publisher
- EP Journals Group
Abstract
Critical infrastructure (CI) sectors, including energy, water, transportation, healthcare, telecommunications, and finance, continue to anchor their cybersecurity assurance in periodic, audit-based compliance: scheduled assessments that certify, at a point in time, that mandated controls exist and are documented. This conceptual review argues that this model is structurally incapable of guaranteeing security in modern CI environments and develops the case for a transition to continuous monitoring and continuous control. Drawing on standards literature, empirical studies of operational technology (OT) security, documented attacks on industrial systems, and the continuous auditing tradition in accounting information systems, the paper synthesizes five interlocking failure modes of periodic compliance: (a) the static-snapshot problem, in which audit findings describe a past state rather than the present one; (b) the error-proneness and limited depth of manual, checklist-driven assessment; (c) configuration drift, through which compliant systems silently degrade between audits; (d) the asymmetry between adversary operational tempo and annual or multi-year audit cycles; and (e) an audit-centric organizational culture that substitutes evidence production for risk reduction. The analysis situates these failures against a threat landscape defined by IT/OT convergence, industrial Internet of Things expansion, deep infrastructure interdependencies, nation-state pre-positioning, and ransomware economics. The paper then traces the intellectual and regulatory lineage of the alternative (continuous auditing, information security continuous monitoring, continuous diagnostics and mitigation, zero trust architecture, and emerging continuous control validation) and discusses implications for regulators, operators, and researchers. The compliance gap, it concludes, is not a maturity deficit but a design flaw requiring an architectural response. As a conceptual review the paper offers an analytic framework rather than an effect estimate: it presents no new data and does not establish that continuous regimes reduce realized risk relative to periodic ones, a limitation stated in full in Section 7.
Keywords: critical infrastructure, audit-based compliance, continuous monitoring, configuration drift, NIST Cybersecurity Framework, operational technology security
Cite this article
Chukwunenye Amadi (2026). The Compliance Gap: Why Audit-Based Cybersecurity Models Fail Critical Infrastructure and the Case for Continuous Control. Global Journal of Engineering and Technology Research, 2(9), 536-562. https://doi.org/10.65150/EP-gjetr/V2E9/2026-12
@article{Chukwunenye2026,
title = {The Compliance Gap: Why Audit-Based Cybersecurity Models Fail Critical Infrastructure and the Case for Continuous Control},
author = {Chukwunenye Amadi},
journal = {Global Journal of Engineering and Technology Research},
year = {2026},
volume = {2},
number = {9},
pages = {536-562},
doi = {10.65150/EP-gjetr/V2E9/2026-12},
url = {https://doi.org/10.65150/EP-gjetr/V2E9/2026-12}
}Questions about this article
Who wrote this article?
Chukwunenye Amadi.
Where and when was it published?
In Global Journal of Engineering and Technology Research, Volume 2, Issue 9, pages 536-562, published by EP Journals Group on 10 September 2026.
Is this article free to read?
Yes. It is open access under a Creative Commons Attribution 4.0 (CC BY 4.0) licence, so anyone can read, share and reuse it with attribution.
What is the DOI of this article?
10.65150/EP-gjetr/V2E9/2026-12 (https://doi.org/10.65150/EP-gjetr/V2E9/2026-12).
How do I cite this article?
APA: Chukwunenye Amadi (2026). The Compliance Gap: Why Audit-Based Cybersecurity Models Fail Critical Infrastructure and the Case for Continuous Control. Global Journal of Engineering and Technology Research, 2(9), 536-562. https://doi.org/10.65150/EP-gjetr/V2E9/2026-12
More research from GJETR
- Optimized Deep Convolutional Networks for MRI Brain Tumor Classification and Segmentation: A Systematic Review
Maher Talal Al-Asaady · Oct 2026
- Industry Micro-Credential Infusion in PQF Level 5 Technology Diploma Programs: Opportunities and Challenges
Gamaliel B. Vicente Jr., Alma O. Medio, Redjie D. Arcadio · Oct 2026
- Assessment of Process Mapping, Risk Management, and Iso 9001 Quality Management Standards: Basis for a Technology-Enabled Quality Management Framework
Patrick E. Arendain, Redjie D. Arcadio · Oct 2026
- Integrating Solar-Powered PV Cells And SCR-Controlled Three-Phase Rectifiers to Design A Two-Level DC Grid Architecture
Sadia Sultana Turna, Amzad Ali Sarkar · Oct 2026
- Density Functional Theory Investigation of Defect-Induced Electronic Behavior in Iodine-Deficient Mapbi₃ Perovskites for Solar Cells
Sani Kado, Muhammad Y. Onimisi, Dahiru M. Sanni · Sept 2026