Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > 3.4 MONITORING RISK > TASK 4-2: Monitor organizational information systems and environments of operation on an ongoing basis to

TASK 4-2: Monitor organizational information systems and environments of operation on an ongoing basis to

verify compliance, determine effectiveness of risk response measures, and identify changes.
Supplemental Guidance: Once organizations complete the development of their monitoring strategies, the strategies are
implemented organization-wide. Because there are so many diverse aspects of monitoring, not all aspects of monitoring
may be performed, or they may be performed at different times. The particular aspects of monitoring that are performed
are dictated largely by the assumptions, constraints, risk tolerance, and priorities/trade-offs established by organizations
during the risk framing step. For example, while organizations might desire to conduct all forms of monitoring (i.e.,
compliance, effectiveness, and change), the constraints imposed upon the organizations may allow only compliance
monitoring that can be readily automated at Tier 3. If multiple aspects of monitoring can be supported, the output from
the risk framing step helps organizations to determine the degree of emphasis and level of effort to place on the various
monitoring activities.
As noted above, not all monitoring activities are conducted at the same tiers, for the same purpose, at the same time, or
using the same techniques. However, it is important that organizations attempt to coordinate the various monitoring
activities. Coordination of monitoring activities facilitates the sharing of risk-related information that may be useful for
organizations in providing early warning, developing trend information, or allocating risk response measures in a
timely and efficient manner. If monitoring is not coordinated, then the benefit of monitoring may be reduced, and could
undermine the overall effort to identify and address risk. As feasible, organizations implement the various monitoring
activities in a manner that maximizes the overall goal of monitoring, looking beyond the limited goals of particular
monitoring activities. Risk monitoring results are applied in performing incremental risk assessments to maintain
awareness of the risk being incurred, to highlight changes in risk, and to indicate the need to revisit other steps in the
risk management process, as appropriate.
Outputs and Post Conditions
The output from the risk monitoring step is the information generated by: (i) verifying that required risk response
measures are implemented and that information security requirements derived from and traceable to organizational
missions/business functions, federal legislation, directives, regulations, policies, and standards/guidelines, are satisfied;
(ii) determining the ongoing effectiveness of risk response measures; and (iii) identifying changes to organizational
information systems and environments of operation. Outputs from the risk monitoring step can be useful inputs to the
risk framing, risk assessment, and risk response steps. For example, compliance monitoring results may require that
organizations revisit the implementation portion of the risk response step, while effectiveness monitoring results may
require that organizations revisit the entire risk response step. The results of monitoring for changes to information
systems and environments of operation may require organizations to revisit the risk assessment step. The results of the
risk monitoring step can also serve the risk framing step (e.g., when organizations discover new threats or
vulnerabilities that affect changes in organizational risk assumptions, risk tolerance, and/or priorities/trade-offs).