DATASHEET

Archer Continuous Monitoring®

Use Case for Public Sector Solutions

The Challenge
Security controls are infrequently and ineffectively assessed using tools from different vendors,with proprietary data formats and limited data sharing. There are typically more findings than
the available staff can manage and remediation of findings is not prioritized using all available
contextual data.
Continuous monitoring (CM) is a combination of manual and automated assessments. Whilevendors who produce automated scanner or sensor tools market their product as “continuousmonitoring solutions,” they do not provide for manual assessments and typically check for only
one defect type (vulnerability or misconfiguration). Updates to Federal Information Security
Management Act (FISMA) and Office of Management and Budget (OMB) guidance createpressure to move CM planning forward, but lack of precedent leaves organizations guessing
about finer implementation details.
Lack of CM in the public sector means defects and vulnerabilities remain open for long periodsof time. It is also difficult to share data or the “big picture” of risk due to the disparity of tools andincomplete and outd ated assessment results. Staffing is insufficient to perform all assessments
and remediate all findings. Lack of business context and visibility means the most critical defects
are not always remediated first. Most organizations do not have the insight and metrics toperform defect rankings, especially with consideration for information system criticality.

Overview
Archer Continuous Monitoring serves as a hub for many types of scanners and sensors, allowing
organizations to build an aggregate risk view at any level of the enterprise. At the lowest end,
individual defects can be monitored and scored. Defects are aggregated at each level of thehierarchy, from the individual device up to the department level. In this way, a risk score can bedesignated at any level and the amount of relative risk introduced can be measured. This allows
resources to be focused on the remediation efforts that will pr ovide the greatest benefit.
®

Archer Continuous Monitoring enables faster, more targeted response to emerging risks. Staff
can mitigate findings in the order in which they will most reduce risk. When used in tandemwith the Archer Assessment & Authorization use case, Archer Continuous Monitoring enhances
your FISMA, OMB and other regulatory compliance activities by verifying that information systems
are abiding by authorization agreements and operating within acceptable levels of risk. This
provides a more secure environment and more insight to make better, more informed risk decisions.

Benefits

Features• Current authoritative hardware and software inventories.

With Archer Continuous Monitoring, you can:• Reduce exposure time.

• Current defect libraries.
• Integration of scanners and sensors into a common		 environment, in a common format.
• Scoring and ranking algorithms for each defect, device		 and layer of the organizational hierarchy.

• Reduce risk overall.
• Increase visibility/better decision-making.
• Access current risk data.
• Increase assurance and confidence based on current data.

• Defect tracking and remediation.

About Archer
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decision-making
and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven by both businessand IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers manage risk and compliancedomains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk management industry, theArcher customer base represents one of the largest pure risk management communities globally, with more than 1,200 customers
including more than 50% of the Fortune 500.
Visit www.ArcherIRM.com.

@ArcherIRM

Archer Integrated Risk Management©2023 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 10/23 Data Sheet.