Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
EXECUTIVE SUMMARY

EXECUTIVE SUMMARY

n today's environment where many, if not all, of an organization's mission-critical functions
are dependent upon information technology, the ability to manage this technology and to
assure confidentiality, integrity, and availability of information is now also mission-critical. In
designing the enterprise architecture and corresponding security architecture, an organization
seeks to securely meet the IT infrastructure needs of its governance structure, missions, and core
business processes. Information security is a dynamic process that must be effectively and
proactively managed for an organization to identify and respond to new vulnerabilities, evolving
threats, and an organization's constantly changing enterprise architecture and operational
environment.
The Risk Management Framework (RMF) developed by NIST,1
describes a disciplined and
structured process that integrates information security and risk management activities into the
system development life cycle. Ongoing monitoring is a critical part of that risk management
process. In addition, an organization's overall security architecture and accompanying security
program are monitored to ensure that organization-wide operations remain within an acceptable
level of risk, despite any changes that occur. Timely, relevant, and accurate information is vital,
particularly when resources are limited and agencies must prioritize their efforts.
Information security continuous monitoring (ISCM) is defined as maintaining
ongoing awareness of information security, vulnerabilities, and threats to support
organizational risk management decisions.
Any effort or process intended to support ongoing monitoring of information security across an
organization begins with leadership defining a comprehensive ISCM strategy encompassing
technology, processes, procedures, operating environments, and people. This strategy:
•
Is grounded in a clear understanding of organizational risk tolerance and helps officials set
priorities and manage risk consistently throughout the organization;
•
Includes metrics that provide meaningful indications of security status at all organizational
tiers;
•
Ensures continued effectiveness of all security controls;
•
Verifies compliance with information security requirements derived from organizational
missions/business functions, federal legislation, directives, regulations, policies, and
standards/guidelines;
•
Is informed by all organizational IT assets and helps to maintain visibility into the security of
the assets;
•
Ensures knowledge and control of changes to organizational systems and environments of
operation; and
•
Maintains awareness of threats and vulnerabilities.
See NIST Special Publication (SP) 800-37, as amended, Guide for Applying the Risk Management Framework to
Federal Information Systems: A Security Life Cycle Approach.
An ISCM program is established to collect information in accordance with preestablished
metrics, utilizing information readily available in part through implemented security controls.
Organizational officials collect and analyze the data regularly and as often as needed to manage
risk as appropriate for each organizational tier. This process involves the entire organization,
from senior leaders providing governance and strategic vision to individuals developing,
implementing, and operating individual systems in support of the organization's core missions
and business processes. Subsequently, determinations are made from an organizational
perspective on whether to conduct mitigation activities or to reject, transfer, or accept risk.
Organizations' security architectures, operational security capabilities, and monitoring processes
will improve and mature over time to better respond to the dynamic threat and vulnerability
landscape. An organization's ISCM strategy and program are routinely reviewed for relevance
and are revised as needed to increase visibility into assets and awareness of vulnerabilities. This
further enables data-driven control of the security of an organization's information infrastructure,
and increase organizational resilience.
Organization-wide monitoring cannot be efficiently achieved through manual processes alone or
through automated processes alone. Where manual processes are used, the processes are
repeatable and verifiable to enable consistent implementation. Automated processes, including
the use of automated support tools (e.g., vulnerability scanning tools, network scanning devices),
can make the process of continuous monitoring more cost-effective, consistent, and efficient.
Many of the technical security controls defined in NIST Special Publication (SP) 800‐53,
Recommended Security Controls for Federal Information Systems and Organizations, as
amended, are good candidates for monitoring using automated tools and techniques. Real‐time
monitoring of implemented technical controls using automated tools can provide an organization
with a much more dynamic view of the effectiveness of those controls and the security posture of
the organization. It is important to recognize that with any comprehensive information security
program, all implemented security controls, including management and operational controls, must
be regularly assessed for effectiveness, even if the monitoring of such controls cannot be
automated or is not easily automated.
Organizations take the following steps to establish, implement, and maintain ISCM:
•
Define an ISCM strategy;
•
Establish an ISCM program;
•
Implement an ISCM program;
•
Analyze data and Report findings;
•
Respond to findings; and
•
Review and Update the ISCM strategy and program.
A robust ISCM program thus enables organizations to move from compliance-driven risk
management to data-driven risk management providing organizations with information necessary
to support risk response decisions, security status information, and ongoing insight into security
control effectiveness.