continuouscompliance.io

What It Is

Continuous Compliance Framework (CCF) is an open-source automated compliance testing and reporting system maintained by the Container Solutions team with community participation. It is not positioned as a traditional firewall or endpoint protection product; instead, it helps organizations continuously assess compliance with NIST SP 800-53, SOC 2, PCI DSS, GDPR, ISO, and internal control catalogs, turning audit workflows that were once periodic, fragmented, and largely manual into continuous validation.

Core Capabilities

In terms of protection category, CCF is a compliance security and GRC automation tool. Its core capabilities include real-time compliance dashboards, tagged findings, assessment groups, reports, and aggregation of results into OSCAL-compatible documents. For deployment, the open-source edition explicitly supports self-hosting, using distributed lightweight compliance collectors/agents to gather information from business environments and send it to a central Compliance API. On the policy side, it uses Rego to implement Policy-as-Code, enabling custom compliance rules to be enforced from source code through to production workflows. For integrations, CCF relies on a plugin and Agent framework, emphasizing the ability to connect to any object that can communicate, thereby reducing vendor lock-in.

Pricing and Support

CCF offers a free Open Source version, including core features, self-hosting, a plugin/Agent framework, public check plugins, dashboards, and community support. The Team plan is priced on request and adds guided onboarding, priority troubleshooting, custom plugin development, and best-practice templates. Enterprise starts from £15,000/year and includes the enterprise edition, selected OSCAL catalogs, support and maintenance, and priority feature requests.

Pros and Cons

Its advantages are that it is open-source, self-hostable, extensible, and well aligned with compliance ecosystems such as OSCAL and NIST, making it suitable for teams that want to engineer compliance controls into their workflows. The downsides are that the available materials do not disclose the product’s own compliance certifications, SLA, permission model, notification/alerting channels, or SaaS-hosted option. Open-source deployment also means users need a certain level of engineering capability and compliance modeling expertise.

Who It’s For and Access from China

CCF is better suited to mid-sized and large organizations with DevSecOps, platform engineering, or GRC automation needs, as well as technical teams that want to use the free version to validate the feasibility of continuous compliance. Access from China, payment methods, and localized support are not clearly specified, so china_access can only be rated as unknown. If local service is required, alternatives to compare include traditional GRC platforms, cloud security compliance scanning tools, or self-built solutions based on OSCAL/OpenSCAP.