Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > 3.2 ESTABLISH AN ISCM PROGRAM > Organizational risk tolerance.36

Organizational risk tolerance.36

•
Threat information. Organizations consider current credible threat information, including
known exploits and attack patterns,
Organizations with a low tolerance for risk (e.g.,
organizations that process, store, or transmit large amounts of proprietary and/or personally
identifiable information (PII), organizations with numerous high-impact systems,
organizations facing specific persistent threats) monitor more frequently than organizations
with a higher tolerance for risk (e.g., organizations with primarily low- and moderate-impact
systems that process, store, or transmit very little PII and/or proprietary information).
•
Vulnerability information.
when establishing monitoring frequencies. For instance,
if a specific attack is developed which exploits a vulnerability of an implemented technology,
temporary or permanent increases to the monitoring frequencies for related controls or
metrics may help provide protection from the threat.
34 System impact levels are in accordance with FIPS 199 and NIST SP 800-60.
Organizations consider current vulnerability information with
respect to information technology products when establishing monitoring frequencies. For
35 See NIST SP 800-34, as amended, Contingency Planning Guide for Federal Information Systems, May 2010.
See NIST SP 800-39, as amended, for more information on how to determine organizational risk tolerance.
37 Attack patterns describe common methods for exploiting software, based on in-depth analysis of specific real-
world attack examples. For more information, see the Common Attack Pattern Enumeration and Classification
(CAPEC) site at http://capec.mitre.org/.
38 For current vulnerability information, see http://www.kb.cert.org/vuls and http://nvd.nist.gov/.
instance, if a specific product manufacturer provides software patches monthly, an
organization might consider conducting vulnerability scans on that product at least that often.
•
Risk assessment results. Results from organizational and/or system-specific assessments of
risk (either formal or informal) are examined and taken into consideration when establishing
monitoring frequencies. For instance, if a system-specific risk assessment identifies potential
threats and vulnerabilities related to nonlocal maintenance (NIST SP 800-53, MA-4), the
organization considers more frequent monitoring of the records kept on nonlocal maintenance
and diagnostic activities. If a risk scoring scheme is in place at the organization, the risk
scores may be used as justification to increase or decrease the monitoring frequencies of
related controls.
•
Output of monitoring strategy reviews. Review and adjustment of the monitoring strategy
is covered in detail in Section 3.6.
•
Reporting requirements. Reporting requirements do not drive the ISCM strategy but may
play a role in the frequency of monitoring. For instance, if OMB policy requires quarterly
reports on the number of unauthorized components detected and corrective actions taken, the
organization would monitor the system for unauthorized components at least quarterly.
Organizations focus on obtaining the data required at the determined frequencies and deploy their
human and capitol resources accordingly. As automation capability or resources are added,
organizations may consider increasing affected monitoring frequencies. Similarly, if resource
availability decreases, the organization considers adjusting affected monitoring frequencies to
ensure that security-related information is appropriately analyzed while continuing to meet
organizational risk management requirements.
Many security controls in the NIST SP 800-53 catalog have multiple implementation
requirements along with control enhancements that may also have multiple implementation
requirements. It may be necessary to assess or monitor individual control requirements and/or
control enhancements within a given control with differing frequencies. For instance, the control
AC-2, Account Management, has ten separate requirements (a. through j.) within the base control
and four control enhancements [(1) through (4)]. The monitoring frequency may vary for each
requirement in accordance with the considerations discussed. For example, AC-2a involves the
identification of account types. For a typical information system, once the account types have
been identified and documented, they are not likely to change very often. For this reason, AC-2a
is a candidate for relatively infrequent assessment. AC-2h involves the deactivation of temporary
accounts and accounts of terminated or transferred users. Since personnel regularly come and go,
a typical organization would most likely assess AC-2h on a more frequent basis than AC-2a. AC-