Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > 3.4 MONITORING RISK > TASK 4-1: Develop a risk monitoring strategy for the organization that includes the purpose, type, and (part 1)

TASK 4-1: Develop a risk monitoring strategy for the organization that includes the purpose, type, and

TASK 4-1: Develop a risk monitoring strategy for the organization that includes the purpose, type, and

frequency of monitoring activities. 64 Compliance verification ensures that organizations have implemented required risk response measures and that
information security requirements derived from and traceable to organizational missions/business functions, federal
legislation, directives, regulations, policies, and standards/guidelines are satisfied. 65 Draft NIST Special Publication 800-137 provides guidance on monitoring organizational information systems and
environments of operation. Supplemental Guidance: Organizations implement risk monitoring programs: (i) to verify that required risk response
measures are implemented and that information security requirements derived from and traceable to organizational
missions/business functions, federal legislation, directives, regulations, policies, and standards/guidelines, are satisfied
(compliance monitoring); (ii) to determine the ongoing effectiveness of risk response measures after the measures have
been implemented (effectiveness monitoring); and (iii) to identify changes to organizational information systems and
the environments in which the systems operate that may affect risk (change monitoring) including changes in the
feasibility of the ongoing implementation of risk response measures). Determining the purpose of risk monitoring
programs directly impacts the means used by organizations to conduct the monitoring activities and where monitoring
occurs (i.e., at which risk management tiers). Organizations also determine the type of monitoring to be employed,
including approaches that rely on automation or approaches that rely on procedural/manual activities with human
intervention. Finally, organizations determine how often monitoring activities are conducted, balancing value gained
from frequent monitoring with potential for operational disruptions due for example, to interruption of mission/business
processes, reduction in operational bandwidth during monitoring, and shift of resources from operations to monitoring. Monitoring strategies developed at Tier 1 influence and provide direction for similar strategies developed at Tier 2 and
Tier 3 including the monitoring activities associated with the Risk Management Framework at the information system
level. Monitoring Compliance
Compliance monitoring is employed to ensure that organizations are implementing needed risk response measures. This includes ensuring that the risk response measures selected and implemented by organizations in response to risk
determinations produced from risk assessments are implemented correctly and operating as intended. Failure to
implement the risk response measures selected by organizations can result in the organizations continuing to be subject
to the identified risk. Compliance monitoring also includes ensuring that risk response measures required by federal
mandates (e.g., legislation, directives, policies, regulations, standards) or organizational mandates (e.g., local policies,
procedures, mission/business requirements) are implemented. Compliance monitoring is the easiest type of monitoring
to perform because there are typically a finite set of risk response measures employed by organizations usually in the
form of security controls. Such measures are typically well-defined and articulated as an output from the risk response
step. The more challenging part of compliance monitoring is evaluating whether the risk response measures are
implemented correctly (and in some instances continuously). Compliance monitoring also includes, as feasible, analysis
as to why compliance failed. The reason for compliance failure can range from individuals failing to do their jobs
correctly to the risk response measure not functioning as intended. If monitoring indicates a failure in compliance, then
the response step of the risk management process is revisited. A key element of the feedback to the response step is the
finding from compliance monitoring indicating the reason for the compliance failure. In some instances, compliance
failures can be fixed by simply re-implementing the same risk response measures with little or no change. But in other
instances, compliance failures are more complicated (e.g., the selected risk response measures are too difficult to
implement or the measures did not function as expected). In such instances, it may be necessary for organizations to
return to the evaluation and decision portions of the risk response step to develop different risk response measures. Monitoring Effectiveness
Effectiveness monitoring is employed by organizations to determine if implemented risk response measures have
actually been effective in reducing identified risk to the desired level. Although effectiveness monitoring is different
than compliance monitoring, failure to achieve desired levels of effectiveness may be an indication that risk response
measures have been implemented incorrectly or are not operating as intended. Determining the effectiveness of risk
response measures is generally more challenging than determining whether the measures have been implemented
correctly and are operating as intended (i.e., meeting identified compliance requirements). Risk response measures
implemented correctly and operating as intended do not guarantee an effective reduction of risk. This is primarily due
to: (i) the complexity of operating environments which may generate unintended consequences; (ii) subsequent changes
in levels of risk or associated risk factors (e.g., threats, vulnerabilities, impact, or likelihood); (iii) inappropriate or
incomplete criteria established as an output of the risk response step; and (iv) changes in information systems and
environments of operation after implementation of risk response measures. This is especially true when organizations
try to determine if more strategic outcomes have been achieved and for more dynamic operating environments.