There's a recurring pattern in vendor security questionnaires. A buyer asks: 'Are you SOC 2 compliant?' The vendor answers: 'Yes, we have a SOC 2 Type II report from [date].' The buyer ticks a box. Both parties move on.

This exchange is structurally broken, and the breakage is so normalised that most participants don't notice. The SOC 2 report tells you the vendor's controls were effective over the audit period (typically the prior 12 months). It says nothing about whether the controls are effective today, this week, or under current operational conditions.

The gap between 'controls were effective during the audit period' and 'controls are effective right now' is where most vendor-risk incidents live. The audit ends in Q4 2025. The control breaks in Q2 2026. The next audit happens in Q4 2026. The customer-visible compliance posture between Q2 and Q4 is wrong — and nobody notices until the post-incident review.

What live compliance evaluation does differently

A live compliance evaluation system evaluates each control's effectiveness on every request, against the actual operational state of the platform. Concretely: each control names the backend services that attest to its effectiveness (e.g., the 'Encryption in Transit' control is attested by the edge-gateway's TLS termination configuration; the 'Encryption at Rest' control is attested by the vault-service and storage-service's encryption posture).

When a user (or auditor, or compliance reviewer) loads the compliance status page, the system probes the health endpoints of each service that attests to each control. The status is computed from the live operational state — not from a snapshot taken months ago.

The output: a control is 'met' if all attesting services are operational; 'partial' if ≥ 50% are operational; 'not met' if < 50% are operational. The status changes in real time as service availability changes.

What this catches that snapshot reports miss

Three categories of compliance failure that live evaluation catches and snapshot reports do not:

• Degraded controls during platform incidents. If the audit-service is degraded for 4 hours during an incident, the 'Audit Logging' control is degraded for 4 hours. Live evaluation reflects this; a SOC 2 report dated 'effective Jan-Dec 2025' shows the control as 'met' for the entire period.
• Configuration drift between audits. A new deployment changes the TLS configuration in a way that breaks the 'Encryption in Transit' control's underlying probe. Live evaluation catches this on the next compliance page load; the snapshot report shows the control as 'met' until the next audit cycle (potentially 11 months away).
• Tenant-specific compliance posture. A SOC 2 report covers 'the system as a whole'. A specific tenant on a specific crypto-policy tier may have a different effective compliance posture than the average — live evaluation can produce a per-tenant report; a snapshot report cannot.

What live evaluation does NOT replace

To be clear: live compliance evaluation does not replace formal SOC 2 / ISO 27001 / HIPAA / PCI DSS / GDPR attestation. The formal attestation is the contractual deliverable that satisfies the regulator or business partner's compliance requirement. Live evaluation is the operational telemetry that lets you know — between attestation cycles — whether your controls are still effective.

Both approaches coexist. The formal attestation tells you 'we passed the audit.' The live evaluation tells you 'we're still passing right now.' A serious vendor offers both.

How QNSP's compliance engine works

QNSP's audit-service maintains a compliance evaluation engine that maps 48 controls across 7 frameworks (SOC 2 Type II, HIPAA, GDPR, PCI DSS v4.0.1, ISO/IEC 27001:2022, PDPA Singapore, MAS TRM Guidelines) to specific backend service health probes.

On every load of the compliance dashboard (authenticated, in the cloud portal at /compliance), the engine probes the relevant services and computes the per-control status. Tenants on the strict crypto-policy tier and above see this live status for SOC 2, HIPAA, and PDPA. Tenants on maximum or government see all 7 frameworks.

The mapping itself is documented publicly at /trust/compliance — including which framework activates on which crypto-policy tier and the specific control counts per framework. This isn't proprietary; the regulatory texts (SOC 2 TSC, HIPAA Security Rule, GDPR articles, etc.) are public, and our mapping of them is transparent.

The vendor-risk implications

For a regulated buyer doing vendor evaluation, the question to add to your questionnaire is: 'Do you provide real-time compliance evaluation against your control mapping, or only snapshot reports?'

A vendor offering both gives you formal evidence (the attestation report) AND operational signal (the live status). A vendor offering only the snapshot is asking you to trust that nothing has drifted since the audit — a trust that, post-incident, you'd want to have validated.

This isn't a niche concern. Continuous-compliance vendors (Drata, Vanta, Secureframe, etc.) have built a category around the gap; their entire premise is that snapshot-based compliance is insufficient. Vendors that embed live evaluation into their own platform — rather than buying it from a third party — are differentiating on the same axis.