Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > Continuous Monitoring > 3.1.2

3.1.2

INFORMATION SYSTEM (TIER 3) ISCM STRATEGY
The system-level ISCM strategy is developed and implemented to support risk management, not
only at the information systems tier, but at all three tiers in accordance with system and
organizational risk tolerance. Although the strategy may be defined at Tiers 1 or 2, system-
specific policy and procedures for implementation may also be developed at Tier 3. System-level
security-related information includes assessment data pertaining to system-level security controls
and metrics data obtained from system-level security controls. System owners establish a system-
level strategy for ISCM by considering factors such as the system's architecture and operational
environment, as well as organizational and mission-level requirements,26
System-level ISCM addresses monitoring security controls for effectiveness (assessments),
monitoring for security status, and reporting findings. At a minimum, all security controls,
including common and hybrid controls implemented at the system level, are assessed for
policy, procedures, and
templates.
26 The ISCM strategy is designed, in part, to help ensure that compromises to the security architecture are managed
in a way to prevent or minimize impact on business and mission functions.
effectiveness in accordance with the system security plan and the methods described in NIST SP
800-53A, as amended. System owners determine assessment frequencies of security controls
based on drivers from all three tiers. A full discussion of factors to consider when determining
assessment and monitoring frequencies can be found in Section 3.2.2. System-level security-
related information is used to determine security status at all three tiers. Use of system-level
security-related information in metrics for determining security status is addressed in Section
3.2.1.
The ISCM strategy at the information systems tier also supports ongoing authorization. Ongoing
authorization implies recurring updates to the authorization decision information in accordance
with assessment and monitoring frequencies. Assessment results from monitoring common
controls implemented and managed at the organization or mission/business process tier may be
combined with information generated at the information systems tier in order to provide the
authorizing official (AO) with a complete set of independently-generated evidence. 27
Primary Roles: Information System Owner/Common Control Provider, Information System
Security Officer
Assessment
evidence obtained from ISCM is, at a minimum, provided to AOs as often as required by
organizational policy.
Supporting Roles: Senior Information Security Officer, Authorizing Official, Security Control
Assessor
Expected Input: Organizational risk tolerance information, organizational ISCM strategy, policy,
procedures, templates, system-specific threat information, and system information (e.g., System
Security Plan, Security Assessment Report, Plan of Action and Milestones, Security Assessment
Plan, System Risk Assessment, etc.28
Expected Output: System-level ISCM strategy that complements the Tier 1 and 2 strategies and
the organizational security program and that provides security status information for all tiers and
real-time updates for ongoing system authorization decisions as directed by the organizational
ISCM strategy
)