Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > Continuous Monitoring > 3.1.1

3.1.1

ORGANIZATION (TIER 1) AND MISSION/BUSINESS PROCESSES (TIER 2) ISCM STRATEGY
The risk executive (function) determines the overall organizational risk tolerance and risk
mitigation strategy at the organization tier.24
When developed at Tiers 1 and/or 2, the following policies, procedures, and templates facilitate
organization-wide, standardized processes in support of the ISCM strategy:
The ISCM strategy is developed and implemented to
support risk management in accordance with organizational risk tolerance. While ISCM strategy,
policy, and procedures may be developed at any tier, typically, the organization-wide ISCM
strategy and associated policy are developed at the organization tier with general procedures for
implementation developed at the mission/business processes tier. If the organization-wide
strategy is developed at the mission/business processes tier, Tier 1officials review and approve
the strategy to ensure that organizational risk tolerance across all missions and business processes
has been appropriately considered. This information is communicated to staff at the
mission/business processes and information systems tiers and reflected in mission/business
processes and information systems tier strategy, policy, and procedures.
•
Policy that defines key metrics;
•
Policy for modifications to and maintenance of the monitoring strategy;
•
Policy and procedures for the assessment of security control effectiveness (common, hybrid,
and system-level controls);
•
Policy and procedures for security status monitoring;
•
Policy and procedures for security status reporting (on control effectiveness and status
monitoring);
•
Policy and procedures for assessing risks and gaining threat information and insights;
•
Policy and procedures for configuration management and security impact analysis;25
•
Policy and procedures for implementation and use of organization-wide tools;
•
Policy and procedures for establishment of monitoring frequencies;
•
Policy and procedures for determining sample sizes and populations and for managing object
sampling;
•
Procedures for determining security metrics and data sources;
24 See NIST SP 800-39, as amended, for a discussion of the risk executive (function) roles and responsibilities.
25 See NIST SP 800-128, as amended, for more information on security-focused configuration management.
•
Templates for assessing risks; and
•
Templates for security status reporting (on control effectiveness and status monitoring).
Policy, procedures, and templates necessarily address manual and automated monitoring
methodologies. Additionally at these tiers, organizations establish policy and procedures for
training of personnel with ISCM roles. This may include training on management and use of
automated tools (e.g., establishing baselines and tuning of measurements to provide accurate
monitoring of operational environments). It may also include training for recognition of and
appropriate response to triggers and alerts from metrics indicating risks beyond acceptable limits,
as well as training on internal or external reporting requirements. This training may be included in
existing role-based training requirements for those with significant security roles, or it may
consist of training specifically focused on implementation of the organization's ISCM policy and
procedures.
When implementing policies, procedures, and templates developed at higher tiers, lower tiers fill
in any gaps related to their tier-specific processes. Decisions and activities by Tier 1 and 2
officials may be constrained by things such as mission/business needs, limitations of the
infrastructure (including the human components), immutable governance policies, and external
drivers.
Primary Roles: Risk Executive (Function), Chief Information Officer, Senior Information
Security Officer, Authorizing Officials
Supporting Roles: Information System Owner/Common Control Provider
Expected Input: Organizational risk assessment and current risk tolerance, current threat
information, organizational expectations and priorities, available tools from OMB lines of
business and/or third-party vendors
Expected Output: Updated information on organizational risk tolerance, organization-wide
ISCM strategy and associated policy, procedures, templates, tools