Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > 3.2 ESTABLISH AN ISCM PROGRAM > 3.2.2

3.2.2

ESTABLISH MONITORING AND ASSESSMENT FREQUENCIES
Determining frequencies for security status monitoring and for security control assessments are
critical functions of the organization's ISCM program. For some organizations, dashboards and
ongoing assessments are a shift away from the model of complete security control assessments
conducted at a distinct point in time. For this shift to be constructive and effective from security,
assurance, and resource use perspectives, organizations determine the frequencies with which
each security control or control element is assessed for effectiveness and the frequencies with
which each metric is monitored.
Security control effectiveness across a tier or throughout the organization can itself be taken as a
security metric and as such may have an associated status monitoring frequency. Though
monitoring and assessment frequencies are determined for each individual metric and control,
organizations use this data of different latencies to create a holistic view of the security of each
system as well as a view of the security of the enterprise architecture. As the monitoring program
matures, monitoring and assessment frequencies are important in the context of how the data is
used and the question When did the system receive authorization to operate? will become less
meaningful than How resilient is the system?
Considerations in Determining Assessment and Monitoring Frequencies.
Organizations take the following criteria into consideration when establishing monitoring
frequencies for metrics or assessment frequencies for security controls:
•
Security control volatility. Volatile security controls are assessed more frequently, whether
the objective is establishing security control effectiveness or supporting calculation of a
metric.33
33 Security control volatility is a measure of how frequently a control is likely to change over time subsequent to its
implementation.
Controls in the NIST SP 800-53 Configuration Management (CM) family are a
good example of volatile controls. Information system configurations typically experience
high rates of change. Unauthorized or unanalyzed changes in the system configuration often
render the system vulnerable to exploits. Therefore, corresponding controls such as CM-6,
Configuration Settings, and CM-8, Information System Component Inventory, may require
more frequent assessment and monitoring, preferably using automated, SCAP-validated tools
that provide alerts and status on demand. Conversely, controls such as PS-2, Position
Categorization, or PS-3, Personnel Screening, (from the NIST SP 800-53 Personnel Security
family of controls) are not volatile in most organizational settings. They tend to remain static
over long periods and would therefore typically require less frequent assessment.
•
System categorizations/impact levels. In general, security controls implemented on systems
that are categorized as high-impact are monitored more frequently than controls implemented
on moderate-impact systems, which are in turn monitored more frequently than controls
implemented on low-impact systems.34
•
Security controls or specific assessment objects providing critical functions. Security
controls or assessment objects that provide critical security functions (e.g., log management
server, firewalls) are candidates for more frequent monitoring. Additionally, individual
assessment objects that support critical security functions and/or are deemed critical to the
system (in accordance with the Business Impact Analysis
•
Security controls with identified weaknesses. Existing risks documented in security
assessment reports (SARs) are considered for more frequent monitoring to ensure that risks
stay within tolerance. Similarly, controls documented in the POA&M as having weaknesses
are monitored more frequently until remediation of the weakness is complete. Note that not
all weaknesses require the same level of monitoring. For example, weaknesses deemed in the
SAR to be of minor or low-impact risk to the system or organization are monitored less
frequently than a weakness with a higher-impact risk to the system or organization.
) or to the organization may be
candidates for more frequent monitoring.
•