DATA SHEET

Archer Continuous Monitoring®

Use Case for Public Sector Solutions

The Challenge
Security controls are infrequently and ineffectively assessed using tools from different
vendors, with proprietary data formats and limited data sharing. There are typically more
findi ngs than the available staff can manage and remediation of findings is not prioritizedusing all available contextual data.
Continuous monitoring (CM) is a combination of manual and automated assessments.
While vendors who produce automated scanner or sensor tools market their productas “continuous monitoring solutions,” they do not provide for manual assessments andtypically check for only one defect type (vulnerability or misconfiguration). Updates
to Federal Information Security Management Act (FISMA) and Office of Management
and Budget (OMB) guidance create pressure to move CM planning forward, but lack ofprecedent leaves organizations guessing about finer implementation details.
Lack of CM in the public sector means defects and vulnerabilities remain open for long
periods of time. It is also diffi cult to share data or the “big picture” of risk due to the disparityof tools and incomplete and outd ated assessment results. Staffing is insufficient to perform
all assessments and remediate all findings. Lack of business context and visibility means
the most critical defects are not always remediated first. Most organizations do not havethe insight and metrics to perform defect rankings, especially with consideration for
information system criticality.

Overview
Archer Continuous Monitoring serves as a hub for many types of scanners and sensors,
allowing organizations to build an aggregate risk view at any level of the enterprise. At
the lowest end, individual defects can be monitored and scored. Defects are aggregatedat each level of the hierarchy, from the individual device up to the department level.
In this way, a risk score can be designated at any level and the amount of relative risk
introduced can be measured. This allows resources to be focused on the remediation
efforts that will pr ovide the greatest benefit.
®

Archer Continuous Monitoring enables faster, more targeted response to emerging
risks. Staff can mitigate findings in the order in which they will most reduce risk. Whenused in tandem with the RSA Arche r Assessment & Authorization use case, Archer
Continuous Monitoring enhances your FISMA, OMB and other regulatory complianceactivities by verifying that information systems are abiding by authorization agreements
and operating within acceptable levels of risk. This provides a more secure environment
and more insight to make better, more informed risk decisions.

Key Features
 Current authoritative hardware andsoftware inventories.
 Current defect libraries.
 Integration of scanners and sensors
into a common environment, ina common format.
 Scoring and ranking algorithms foreach defect, device and layer of theorganizational hierarchy.
 Defect tracking and remediation.

Key Benefits
With Archer Continuous Monitoring,organizations can: Reduce exposure time.
 Reduce risk overall.
 Increase visibility/better
decision-making.
 Access current risk data.
 Increase assurance and confidence
based on current data.

Discover More
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decisionmaking and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven
by both business and IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers manage
risk and compliance domains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk
management industry, the Archer customer base represents one of the largest pure risk management communities globally, withmore than 1,200 customers including more than 50% of the Fortune 500.

©2022 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of Archer
Technologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 11/22 Data Sheet.