Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > 3.2 ESTABLISH AN ISCM PROGRAM > 3.2.1

3.2.1

DETERMINE METRICS
Organizations determine metrics to be used to evaluate and control ongoing risk to the
organization. Metrics, which include all the security-related information from assessments and
monitoring produced by automated tools and manual procedures, are organized into meaningful
information to support decision making and reporting requirements. Metrics should be derived
from specific objectives that will maintain or improve security posture. Metrics are developed for
system-level data to make it meaningful in the context of mission/business or organizational risk
management.
Metrics may use security-related information acquired at different frequencies and therefore with
varying data latencies. Metrics may be calculated from a combination of security status
monitoring, security control assessment data, and from data collected from one or more security
controls. Metrics may be determined at any tier or across an organization. Some examples of
metrics are the number and severity of vulnerabilities revealed and remediated, number of
unauthorized access attempts, configuration baseline information, contingency plan testing dates
and results, and number of employees who are current on awareness training requirements, risk
tolerance thresholds for organizations, and the risk score associated with a given system
configuration.
As an example, a metric that an organization might use to monitor status of authorized and
unauthorized components on a network could rely on related metrics such as physical asset
locations, logical asset locations (subnets/Internet protocol (IP) addresses), media access control
(MAC) addresses, system association, and policies/procedures for network connectivity. The
metrics would be refreshed at various frequencies in accordance with the ISCM strategy. The
metrics might be computed hourly, daily, or weekly. Though logical asset information might
change daily, it is likely that policies and procedures for network connectivity will be reviewed or
revised no more than annually. These metrics are informative only and are not recommended
metrics. They are included to assist in explaining the concept of metrics as they are applied across
tiers. Organizations define their own metrics and associated monitoring frequencies. In order to
calculate metrics, associated controls and/or their objects are assessed and monitored with
frequencies consistent with the timing requirements expressed in the metric.
It should be noted that metrics are fundamentally flawed without assurance that all security
controls are implemented correctly. Metrics are defined or calculated in accordance with output
from the security architecture. Collecting metrics from a security architecture with security
controls that have not been assessed is equivalent to using a broken or uncalibrated scale. The
interpretation of metrics data presumes that controls directly and indirectly used in the metric
calculation are implemented and working as anticipated. If a metric indicates a problem, the root
cause could be any number of things. Without fundamental assurance of correct implementation
and continued effectiveness of security controls that are not associated with the metric, the root
cause analysis is going to be hampered, and the analysis may be inappropriately narrowed to a
predetermined list, overlooking the true problem. For detailed information on establishing
metrics, see NIST SP 800-55, as amended.
Primary Roles: Risk Executive (Function), Chief Information Officer, Senior Information
Security Officer
Supporting Roles: Authorizing Officials, Information System Owner/Common Control Provider
Expected Input: Organizational risk assessment, organizational risk tolerance, current threat
information, reporting requirements, current vulnerability information
Expected Output: Established metrics to convey security status and security control
effectiveness at all three tiers, and to give recipients/users of reports visibility into assets,
awareness of vulnerabilities, and knowledge of threats