ezesecops/rmf-ato-core huggingface dataset:
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Appendix III5 > 1.2 RELATIONSHIP TO OTHER SPECIAL PUBLICATIONS

1.2 RELATIONSHIP TO OTHER SPECIAL PUBLICATIONS

NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information
System View, describes three key organization-wide ISCM activities: monitoring for
effectiveness, monitoring for changes to systems and environments of operation, and monitoring
4 See OMB Memoranda M-11-33, Question #28, for information on ongoing authorization
(http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-33.pdf).
OMB Circular A-130 is available at http://www.whitehouse.gov/omb/circulars_a130_a130trans4.
OMB memorandum M-11-33 is available at
http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-33.pdf.
for compliance. NIST SP 800-37 describes monitoring security controls at the system level (RMF
Step 6) and also includes an organization-wide perspective, integration with the system
development life cycle (SDLC), and support for ongoing authorizations. The concepts presented
in NIST SP 800-39 and NIST SP 800-37 are expanded upon in order to provide guidelines
sufficient for developing an ISCM strategy and implementing an ISCM program.
The tiered approach herein mirrors that described in NIST SP 800-37 and NIST SP 800-39 where
Tier 1 is organization, Tier 2 is mission/business processes, and Tier 3 is information systems. In
NIST SP 800-39, these tiers are used to address risk management from varying organizational
perspectives. In this document, the tiers are used to address perspectives for ISCM for each tier.
Organization-wide, tier-specific ISCM policies, procedures, and responsibilities are included for
the organization, mission/business processes, and information systems tiers. Automation is
leveraged where possible, and manual (e.g., procedural) monitoring methodologies are
implemented where automation is not practical or possible.
The ISCM program will evolve over time as the program matures in general, additional tools and
resources become available, measurement and automation capabilities mature, and changes are
implemented to ensure continuous improvement in the organizational security posture and in the
organization's security program. The monitoring strategy is regularly reviewed for relevance and
accuracy in reflecting organizational risk tolerances, correctness of measurements, applicability
of metrics, and effectiveness in supporting risk management decisions.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Appendix III5 > 1.3 PURPOSE

1.3 PURPOSE

The purpose of this guideline is to assist organizations in the development of an ISCM strategy
and the implementation of an ISCM program that provides awareness of threats and
vulnerabilities, visibility into organizational assets, and the effectiveness of deployed security
controls. The ISCM strategy and program support ongoing assurance that planned and
implemented security controls are aligned with organizational risk tolerance, as well as the ability
to provide the information needed to respond to risk in a timely manner.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Appendix III5 > 1.4 TARGET AUDIENCE

1.4 TARGET AUDIENCE

This publication serves individuals associated with the design, development, implementation,
operation, maintenance, and disposal of federal information systems, including:
•
Individuals with mission/business ownership responsibilities or fiduciary responsibilities
(e.g., heads of federal agencies, chief executive officers, chief financial officers);
•
Individuals with information system development and integration responsibilities (e.g.,
program managers, information technology product developers, information system
developers, information systems integrators, enterprise architects, information security
architects);
•
Individuals with information system and/or security management/oversight responsibilities
(e.g., senior leaders, risk executives, authorizing officials, chief information officers, senior
information security officers7
At the agency level, this position is known as the Senior Agency Information Security Officer. Organizations may
also refer to this position as the Chief Information Security Officer.
);
•
Individuals with information system and security control assessment and monitoring
responsibilities (e.g., system evaluators, assessors/assessment teams, independent verification
and validation assessors, auditors, or information system owners); and
•
Individuals with information security implementation and operational responsibilities (e.g.,
information system owners, common control providers, information owners/stewards,
mission/business owners, information security architects, information system security
engineers/officers).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER TWO > 2.1 ORGANIZATION-WIDE VIEW OF ISCM > 2.1.1

2.1.1

TIER 1- ORGANIZATION
Tier 1 risk management activities address high-level information security governance policy as it
relates to risk to the organization as a whole, to its core missions, and to its business functions. At
this tier, the criteria for ISCM are defined by the organization's risk management strategy,
including how the organization plans to assess, respond to, and monitor risk, and the oversight
required to ensure that the risk management strategy is effective. Security controls, security status,
and other metrics defined and monitored by officials at this tier are designed to deliver information
necessary to make risk management decisions in support of governance. Tier 1 metrics are
developed for supporting governance decisions regarding the organization, its core missions, and
14 NIST Special Publication 800-39, as amended, provides guidelines on the holistic approach to risk management.
ORGANIZATION
Risk Tolerance/
Governance/Policies/
Strategies
INFORMATION SYSTEMS
Collection/Correlation/Analysis/Reporting
Data
MISSION/BUSINESS PROCESSES
Collection/Correlation/Analysis/Reporting
Tools
Data
Tools
and monitor risk across the organization. The ongoing monitoring activities implemented at the
information systems tier provide security-related information to authorizing officials (AOs) in
support of ongoing system authorization decisions and to the risk executive (function) in support
of ongoing organizational risk management.
At Tier 3, RMF Step 6 Monitor activities and ISCM activities are closely aligned. The assessment
methods relevant for implemented security controls are the same whether the assessments are
being done solely in support of system authorization or in support of a broader, more
comprehensive continuous monitoring effort. Information systems tier officials and staff conduct
assessments and monitoring, and analyze results on an ongoing basis. The information is
leveraged at the organization, mission/business processes, and information systems tiers to
support risk management. Though frequency requirements differ, each tier receives the benefit of
security-related information that is current and applicable to affected processes. RMF Step 6
activities performed within the context of an ISCM program support information system risk
determination and acceptance, i.e., authorization (RMF Step 5) on an ongoing basis.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER TWO > 2.2 ONGOING SYSTEM AUTHORIZATIONS

2.2 ONGOING SYSTEM AUTHORIZATIONS

Initial authorization to operate is based on evidence available at one point in time, but systems
and environments of operation change. Ongoing assessment of security control effectiveness
supports a system's security authorization over time in highly dynamic environments of operation
with changing threats, vulnerabilities, technologies, and missions/business processes. Through
ISCM, new threat or vulnerability information is evaluated as it becomes available, permitting
organizations to make adjustments to security requirements or individual controls as needed to
maintain authorization decisions. The process for obtaining system authorization, and more
generally, for managing information security and information system-related risk, is the RMF.19
The RMF, illustrated in Figure 2-2, provides a disciplined and structured process that integrates
information system security and risk management activities into the SDLC. The monitoring step
(Step 6) of the RMF includes interactions between the three tiers as illustrated in the
organizational view of ISCM in Figure 2-1. Interaction between the tiers includes data from
system owners, common control providers, and authorizing officials on security control
assessments and ongoing authorization of system and common controls provided to the risk
executive (function).20
19 System authorization to operate may be partially dependent on assessment/monitoring and ongoing security
authorization of common controls. NIST SP 800-37, as amended, provides information on security authorization
of common controls.
There is also dissemination of updated risk-related information such as
vulnerability and threat data and organizational risk tolerance from Tiers 1 and 2 to authorizing
officials and information system owners. When the RMF is applied within an organization that
has also implemented a robust ISCM strategy, organizational officials are provided with a view of
the organizational security posture and each system's contribution to said posture on demand.
20 Roles and responsibilities of organizational officials within a continuous monitoring program are discussed in
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > 3.1 DEFINE ISCM STRATEGY

3.1 DEFINE ISCM STRATEGY

Effective ISCM begins with development of a strategy that addresses ISCM requirements and
activities at each organizational tier (organization, mission/business processes, and information
systems). Each tier monitors security metrics and assesses security control effectiveness with
established monitoring and assessment frequencies and status reports customized to support tier-
specific decision making. Policies, procedures, tools, and templates that are implemented from
Tiers 1 and 2, or that are managed in accordance with guidance from Tiers 1 and 2, best support
shared use of data within and across tiers. The lower tiers may require information in addition to
that required at higher tiers and hence develop tier-specific strategies that are consistent with
those at higher tiers and still sufficient to address local tier requirements for decision making.
Depending on the organization, there may be overlap in the tasks and activities conducted at each
tier.
The guidelines below, though not prescriptive, helps to ensure an organization-wide approach to
ISCM that best promotes standardized methodologies and consistent practices and hence
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > 3.2 ESTABLISH AN ISCM PROGRAM

3.2 ESTABLISH AN ISCM PROGRAM

Organizations establish a program to implement the ISCM strategy. The program is sufficient to
inform risk-based decisions and maintain operations within established risk tolerances. Goals
include detection of anomalies and changes in the organization's environments of operation and
information systems, visibility into assets, awareness of vulnerabilities, knowledge of threats,
security control effectiveness, and security status including compliance. Metrics are designed and
frequencies determined to ensure that information needed to manage risk to within organizational
risk tolerances is available. Tools, technologies, and manual and/or automated methodologies are
implemented within the context of an architecture designed to deliver the required information in
the appropriate context and at the right frequencies.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.2.3

3.2.3

DEVELOP ISCM ARCHITECTURE
Organizations determine how the information will be collected and delivered within and between
the tiers as well as external to the organization. The core requirements of an architecture
implemented to support ISCM are data collection, data storage, data analysis capabilities, and
retrieval and presentation (reporting) capabilities. Methodologies are standardized to facilitate
efficiencies, intra- and inter-tier information exchange, correlation, and other analysis.
Organizations use automated tools, technologies, and methodologies where appropriate to allow
for increased efficiencies and insight including those gained through collection, analysis and
dissemination of large volumes of data from diverse sources. The architecture and associated
policies and procedures are designed to minimize data calls and maximize data reuse.39
39 An example of an architecture for ISCM can be found in Draft NISTIR 7756, CAESARS Framework Extension:
An Enterprise Continuous Monitoring Technical Reference Architecture (Draft).
Data
feeds come from a heterogeneous mix of sources (e.g., authorization packages, training records,
system logs) and accommodate different stakeholder views. Interoperable data specifications
(e.g., SCAP, XML) enable data to be collected once and reused many times. Accountability for
different facets of the security posture may reside with different roles or functions within an
organization and hence require use of raw data in different metrics and contexts and at different
intervals (e.g., security assessment and authorization, user awareness and training, and access
control). Similarly, organizational missions and business functions have varied requirements for
reporting and various drivers for action (e.g., changes to risk tolerance; changes in operational
environments, including evolving threat activities; security architecture adjustments, security
status reporting).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.3 IMPLEMENT AN ISCM PROGRAM

3.3 IMPLEMENT AN ISCM PROGRAM

ISCM is implemented in accordance with the strategy. Security-related information (data) is
collected as required for predefined metrics, security control assessments are conducted, and the
security-related information generated is reported in accordance with organizational policies and
procedures. All security control classes (management, operational, and technical) and types
(common, hybrid, and system-specific) are included in the organizational continuous monitoring
program. Every control is monitored for effectiveness, and every control is subject to use in
monitoring security status. Data sources include people, processes, technologies, the computing
environment, as well as any existing relevant security control assessment reports.
Collection, analysis, and reporting of data are automated where possible. Whether manual or
automated, the data collected is assembled for analysis and reported to the organizational officials
charged with correlating and analyzing it in ways that are relevant for risk management activities.
As indicated in the examples above, this may mean taking data from a variety of sources,
collected at various points in time, and combining it in ways that are meaningful for the official
receiving it at the time that it is requested. Part of the implementation stage of the continuous
monitoring process is effectively organizing and delivering ISCM data to stakeholders in
accordance with decision-making requirements. Tools and methodologies are chosen for the
organization-wide ISCM architecture, in order to help ensure that risk-based decisions are
informed by accurate, current security-related information.
Discrete security processes inform and are informed by ISCM data. Organizations also use ISCM
data to inform processes that are not primarily used to control information security risk. Similarly,
data from those processes can also be used to inform the ISCM program. Examples of processes
that inform and are informed by ISCM include, but are not limited to, patch management, asset
management, license management, configuration management, vulnerability management, and
system authorization.
As described in Chapter Two, the ISCM data output from one process may serve as input to many
others.
Primary Roles: Information System Owner, Common Control Provider, Information System
Security Officer, Security Control Assessor
Supporting Roles: Risk Executive (Function), Authorizing Official, Chief Information Officer,
Senior Information Security Officer
Expected Input: Organizational- and system-level policies and procedures on ISCM strategy,
metrics, the Security Assessment Plan updated with assessment and monitoring frequencies, and
automation specifications
Expected Outputs: Security-related information
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.4 ANALYZE DATA AND REPORT FINDINGS

3.4 ANALYZE DATA AND REPORT FINDINGS

Organizations develop procedures for analyzing and reporting assessment and monitoring results.
This includes the specific staff/roles to receive ISCM reports, the content and format of the
reports, the frequency of reports, and any tools to be used. Also included are requirements for
analyzing and reporting results of controls that are not easily automated. It may be necessary to
collect additional data to supplement or clarify security-related information under analysis or
provided in initial reports. System- and mission/business-level staff receives and provides reports
as required by organizational and mission/business-level policies and procedures.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.4 ANALYZE DATA AND REPORT FINDINGS > 3.4.3

3.4.3

REPORT ON SECURITY STATUS MONITORING
Organizations develop procedures for reporting on security status monitoring. Security status data
is derived from monitoring the predefined metrics across the organization using output generated
40 Reporting frequencies noted here are for illustrative purposes only.
by organization-wide tools (often implemented as common controls). The organization-wide tools
may be part of a specific system or systems, but the security-related information generated may
not be system-specific.
Primary Roles: System Owner, Common Control Provider, System Security Officer, Security
Control Assessor
Supporting Roles: Risk Executive (Function), Chief Information Officer, Chief Information
Security Officer, Authorizing Official
Expected Input: Security-related information (security status data); organizational ISCM
policies and procedures; reporting requirements from the Authorizing Official, Chief Information
Officer, Chief Information Security Officer, and/or Risk Executive (Function)
Expected Output: Reports on security status as required by organizational ISCM policies and
procedures and by the Authorizing Official in support of ongoing authorization (or re-
authorization)
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX A

Security-Focused Configuration Management of Information Systems, August 2011.
CAESARS Framework Extension: an Enterprise Continuous Monitoring Technical
Reference Architecture, February 2011.
OTHER
1. Common Vulnerabilities and Exposures (CVE), http://cve.mitre.org/about/index.html.
2. Common Vulnerability Scoring System (CVSS), http://www.first.org/cvss/.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

The Open Checklist Interactive Language (OCIL), discussed in Section D.3.1, may be used to
partially automate certain controls that require human interaction and can be verified in a question
and answer type format. For example, it may be possible to create an automated questionnaire to
gather information related to annual security awareness training.
The validity of the security-related information collected continuously or on demand from
automated tools assumes the continued effectiveness of the underlying management and
operational security controls. As such, the value of automated tools and technologies, including
those that perform direct data gathering and aggregation and analysis of data, is dependent upon
the operational processes supporting their use. For organizations to realize the operational
security benefits and for the tools and technologies to provide an accurate security status,
knowledgeable staff should select, implement, operate, and maintain these tools and technologies,
as well as all underlying security controls, interpret the monitoring data obtained, and select and
implement appropriate remediation.
This appendix discusses the role of tools and technologies in automating many ISCM activities. It
discusses common tools, technologies, and open specifications used to collect, analyze, and
meaningfully represent data in support of continuous monitoring of an organization's security
posture, including providing visibility into the information assets, awareness of threats and
vulnerabilities, and status of security control effectiveness. Examples of security controls that can
be automated using the various technologies are included. This is not an exhaustive set of
examples. New products and technologies continue to reach the market. Controls commonly
automated but that do not appear as examples associated with the technologies named below
include those where automation is achieved through capabilities built into operating systems,
custom tools and scripts, or a combination of several tools and capabilities.45
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

•
Documentation (e.g., text file) that guides the checklist user to manually configure software;
•
Documents that explain the recommended methods to securely install and configure a device;
and
•
Policy documents that set forth guidelines for such activities as auditing, authentication
security (e.g., passwords), and perimeter security.
Not all instructions in a security configuration checklist are for security settings. Checklists can
also include administrative practices for an IT product that go hand in hand with improvements to
the product's security. Often, successful attacks on systems are the direct result of poor
administrative practices such as not changing default passwords or failure to apply new patches.
A checklist comparison can also be performed as part of auditing and continuous monitoring of
deployed systems' security, to ensure that the baseline configurations are maintained. It is not
normally sufficient to configure a computer once and assume that the settings will be maintained;
settings may change as software is installed, upgraded, and patched, or as computers are
connected and disconnected from domains. Users might also alter security settings, such as in the
case of a user who feels that a locking screen saver is inconvenient and hence turns the feature
off.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

This section describes the tools and technologies within eleven security automation domains that
support continuous monitoring:
•
Vulnerability Management;
•
Patch Management;
•
Event Management;
•
Incident Management;
•
Malware Detection;
•
Asset Management;
•
Configuration Management;
•
Network Management;
•
License Management;
•
Information Management; and
•
Software Assurance.
The domains are pictured in Figure D-1.