In critical infrastructure, compliance isn't only checked during audit periods. In OT security, continuous monitoring of controls, gathering evidence, and early detection of compliance gaps are necessary.