Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.5 RESPOND TO FINDINGS

3.5 RESPOND TO FINDINGS

Security-related information obtained from monitoring is analyzed and met with appropriate
responses. Response to findings at all tiers may include risk mitigation, risk acceptance, risk
avoidance/rejection, or risk sharing/transfer, in accordance with organizational risk tolerance.41
Responses are coordinated with appropriate security management activities such as the security-
focused configuration management program. At Tier 1, response to findings may result in
changes to security policies around organizational governance. Tier 1's response may be
constrained by the mission/business needs and the limitations of the enterprise architecture
(including the human components), immutable governance policies, or other external drivers. At
Tier 2, response to findings may include requests for additional security-related information, new
or modified metrics, changes in mission/business processes, or Tier 3 reporting requirements,
and/or additions or modifications to common control implementations. The Tier 2 response may
be constrained by organizational governance policies and strategies as well as mission/business
goals and objectives and limitations of organizational resources and infrastructure. At Tier 3,
mitigation strategies have a direct and immediate impact on system-level risk and responses to
findings may include implementation of additional controls, modifications to previously
implemented controls, removal of systems' authorization to operate, changes to the frequency of
monitoring, and/or additional or more detailed analysis of security-related information. System-
level mitigations are made within constraints set by Tier 1 and 2 policies, requirements, and
strategies, to ensure that organizational processes are not negatively affected.
Response strategies may be implemented over a period of time, documenting implementation
plans in the system's Plan of Action and Milestones. As weaknesses are found, response actions
are evaluated and any mitigation actions are conducted immediately or are added to the POA&M.
Other key system documents are updated accordingly. Security controls that are modified,
enhanced, or added as part of the response step of the continuous monitoring process are assessed
41 For a detailed description of risk responses, see NIST SP 800-39, as amended.
to ensure that the new or revised controls are effective in their implementations.42
Going forward,
new or revised controls are included in the overall continuous monitoring strategy.
Primary Roles: System Owner, Common Control Provider, System Security Officer
Supporting Roles: Authorizing Official, Senior Information Security Officer, Information
Owner/Steward
Expected Input: Reports on security status, reports on assessment results (e.g., Security
Assessment Reports), organizational- and system-level risk assessments, Security Assessment
Plans, System Security Plans, organizational procedures and templates
Expected Output: Decisions on risk responses, updated system security information (e.g.,
System Security Plans, POA&Ms, Security Assessment Reports), updated security status reports