Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > Continuous Monitoring > 3.1.3

3.1.3

PROCESS ROLES AND RESPONSIBILITIES
Tiers 1 and 2 officials have responsibilities throughout the ISCM process, including, but not
limited to, the following:
•
Provide input to the development of the organizational ISCM strategy including
establishment of metrics, policy, and procedures, compiling and correlating Tier 3 data into
security-related information of use at Tiers 1 and 2, policies on assessment and monitoring
frequencies, and provisions for ensuring sufficient depth and coverage when sampling
methodologies are utilized [ISCM steps: Define, Establish, Implement].
See NIST SP 800-53, CA-2, Control Enhancement 1, for specific assessor independence requirements. Assessors
need only be independent of the operation of the system. They may be from within the organizational tier, the
mission/business tier, or from within some other independent entity internal or external to the organization.
Results of assessments done by system operators can be used if they have been validated by independent
assessors.
28 This system information is an outcome of the RMF. Electronic standardized templates and document management
systems readily support frequent updates with data generated by continuous monitoring programs.
•
Review monitoring results (security-related information) to determine security status in
accordance with organizational policy and definitions [ISCM step: Analyze/Report].
•
Analyze potential security impact to organization and mission/business process functions
resulting from changes to information systems and their environments of operation, along
with the security impact to the enterprise architecture resulting from the addition or removal
of information systems [ISCM step: Analyze/Report].
•
Make a determination as to whether or not current risk is within organizational risk tolerance
levels [ISCM steps: Analyze/Report, Review/Update].
•
Take steps to respond to risk as needed (e.g., request new or revised metrics, additional or
revised assessments, modifications to existing common or PM security controls, or additional
controls) based on the results of ongoing monitoring activities and assessment of risk [ISCM
step: Respond].
•
Update relevant security documentation [ISCM step: Respond].
•
Review new or modified legislation, directives, policies, etc., for any changes to security
requirements [ISCM step: Review/Update].
•
Review monitoring results to determine if organizational plans and polices should be adjusted
or updated [ISCM step: Review/Update].
•
Review monitoring results to identify new information on vulnerabilities [ISCM step:
Review/Update].
•
Review information on new or emerging threats as evidenced by threat activities present in
monitoring results, threat modeling (asset- and attack-based), classified and unclassified
threat briefs, USCERT reports, and other information available through trusted sources,
interagency sharing, and external government sources [ISCM step: Review/Update].
Tier 3 officials have responsibilities throughout the ISCM process including, but not limited to,
the following:
•
Provide input to the development and implementation of the organization-wide ISCM
strategy along with development and implementation of the system level ISCM strategy
[ISCM steps: Define, Establish, Implement; RMF Step: Select].
•
Support planning and implementation of security controls, the deployment of automation
tools, and how those tools interface with one another in support of the ISCM strategy [ISCM
step: Implement; RMF Step: Select].
•
Determine the security impact of changes to the information system and its environment of
operation, including changes associated with commissioning or decommissioning the system
[ISCM step: Analyze/Report; RMF Step: Monitor].
•
Assess ongoing security control effectiveness [ISCM step: Implement; RMF Steps: Assess,29
•
Take steps to respond to risk as needed (e.g., request additional or revised assessments,
modify existing security controls, implement additional security controls, accept risk, etc.)
based on the results of ongoing monitoring activities, assessment of risk, and outstanding
items in the plan of action and milestones [ISCM step: Respond; RMF Step: Monitor].
Monitor].
•
Provide ongoing input to the security plan, security assessment report, and plan of action and
milestones based on the results of the ISCM process [ISCM step: Respond; RMF Step: 6].
•
Report the security status of the information system including the data needed to inform Tiers
1 and 2 metrics [ISCM step: Analyze/Report; RMF Steps: Assess, Monitor].
•
Review the reported security status of the information system to determine whether the risk to
the system and the organization remains within organizational risk tolerances [ISCM step:
Analyze/Report; RMF Steps: Authorize, Monitor].