Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.4 ANALYZE DATA AND REPORT FINDINGS > 3.4.1

3.4.1

ANALYZE DATA
Organizations analyze the security-related information resulting from ISCM. It may be necessary
to collect additional data to supplement or clarify security-related information under analysis. The
information to be analyzed is provided to organizational officials in a variety of ways, such as
recurring reports, automated reports, ad hoc reports, data feeds, and database views.
Security-related information resulting from ISCM is analyzed in the context of stated risk
tolerances, the potential impact that vulnerabilities may have on information systems,
mission/business processes, and organization as a whole, and the potential impact of mitigation
options. Even with real-time or near real-time organization-specific and system-specific security-
related information, evolving vulnerability and threat data is always considered during the
analysis. Organizational officials review the analyzed reports to determine whether to conduct
mitigation activities or to transfer, avoid/reject, or accept risk. In some cases, authorizing officials
may determine that accepting some specific risk is preferable to implementing a mitigating
response. The rationale for such determinations may include organizational risk tolerance,
negative impact to mission/business processes, or cost-effectiveness/return on investment of the
implementation. Resolution of risk and the rationale for the decision is recorded in accordance
with organizational policies and procedures.
Primary Roles: Risk Executive (Function), Chief Information Officer, Senior Information
Security Officer; Authorization Officials, Security Control Assessors
Supporting Roles: Information System Owners, Common Control Providers, System Security
Officers
Expected Input: Security-related information, organizational ISCM strategy, organizational risk
tolerance, reporting requirements
Expected Output: Analysis of security status information for all tiers; updated System Security
Plan, Security Assessment Report, and Plan of Action and Milestones; revised organizational risk
management decisions
3.4.2 REPORT ON SECURITY CONTROL ASSESSMENTS
Organizations report on assessments of all implemented security controls for effectiveness in
accordance with organizational requirements. Security-related information from assessments may
be conveyed in templates or spreadsheets or collected and reported in an automated fashion. At
the system level, security-related information from assessments directly supports ongoing
authorization decisions and plans of action and milestones creation and tracking. Some security
controls or elements of security controls, by definition, are security metrics (e.g., SI-4
Information System Monitoring). Hence, assessing the effectiveness of these controls results in
monitoring the security status of the related metric.
Staff report assessment results in accordance with organizational policies and procedures.
Reporting on additional metrics and/or assessment results may be required by higher-level
organizations such as OMB. Organizations define security status reporting requirements in the
ISCM strategy. This includes the specific staff/roles to receive ISCM reports, the content and
format of the reports, the frequency of reports, and any tools to be used.
Tier 3 officials report on findings, document any system-level mitigations made, and/or provide
recommendations to officials at Tiers 1 and 2. Organizational officials at Tiers 1 and 2 review
Tier 3 findings to determine aggregate security status and the effectiveness and adequacy of all
controls in meeting mission/business and organizational information security requirements.
Information contained within a report will vary based on its recipient, frequency, purpose,
supported tool sets, and metrics used. For example, the risk executive (function) may receive a
general report on all systems annually and a detailed report on specific high-impact systems
quarterly. The reports provided to the CIO and SISO may contain more granular technical data on
all systems quarterly, and the AO may receive monthly comprehensive reports on the systems for
which s/he is responsible. The computer incident response team (CIRT) lead may receive
exception reports when alerts are generated, and network administrators may review dashboards
showing network activity that is updated every minute, with summary metrics that are updated
hourly or daily.40
Organizations also define requirements for reporting results of controls, such as PM controls, that
are not easily automated. Organizations develop procedures for collecting and reporting
assessment and monitoring results, including results that are derived via manual methods, and for
managing and collecting information from POA&Ms to be used for frequency determination,
status reporting, and monitoring strategy revision.
Organizations may consider more frequent reports for specific controls with
more volatility or on controls for which there have been weaknesses or lack of compliance.
Primary Roles: System Owner, Common Control Provider, System Security Officer, Security
Control Assessor
Supporting Roles: Risk Executive (Function), Chief Information Officer, Chief Information
Security Officer, Authorizing Official
Expected Input: Security-related information (assessment results); organizational ISCM policies
and procedures; reporting requirements from the Authorizing Official, Chief Information Officer,
Chief Information Security Officer, and/or Risk Executive (Function)
Expected Output: Reports on assessment results as required by organizational ISCM policies
and procedures and by the Authorizing Official in support of ongoing authorization (or
reauthorization)