Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER TWO > THE FUNDAMENTALS

THE FUNDAMENTALS

ONGOING MONITORING IN SUPPORT OF RISK MANAGEMENT
his chapter describes the fundamental concepts associated with organization-wide
continuous monitoring of information security and the application of ISCM in support of
organizational risk management decisions (e.g., risk response decisions, ongoing system
authorization decisions, Plans of Action and Milestones (POA&M) resource and prioritization
decisions, etc.). In order to effectively address ever-increasing security challenges, a well-
designed ISCM strategy addresses monitoring and assessment of security controls for
effectiveness, and security status monitoring.8
The process of implementing ISCM as described in Chapter Three is:
It also incorporates processes to assure that
response actions are taken in accordance with findings and organizational risk tolerances and to
assure that said responses have the intended effects.
•
Define the ISCM strategy;
•
Establish an ISCM program;
•
Implement the ISCM program;
•
Analyze and Report findings;
•
Respond to findings; and
•
Review and Update ISCM strategy and program.
ISCM strategies evolve in accordance with drivers for risk-based decision making and
requirements for information. These requirements may come from any tier in the organization.
Organizations implement ISCM based on requirements of those accountable and responsible for
maintaining ongoing control of organizational security posture to within organizational risk
tolerances. The implementation is standardized across the organization to the greatest extent
possible so as to minimize use of resources (e.g., funding for purchase of tools/applications, data
calls, organization-wide policies/procedures/templates, etc.) and to maximize leveragability of
security-related information. Upon analysis, the resulting information informs the discrete
processes used to manage the organization's security posture and overall risk. ISCM helps to
provide situational awareness of the security status of the organization's systems based on
information collected from resources (e.g., people, processes, technology, environment) and the
capabilities in place to react as the situation changes.
Organizations implement processes to manage organizational security and metrics that provide insight into those
processes and hence into organizational security status. Some of those security processes will align with individual
security controls, and others will align with components or combinations of controls. Discussions of metrics can
be found in Section 3.2.1 and in NIST SP 800-55, Performance Measurement Guide for Information Security, as
amended.
T
ISCM is a tactic in a larger strategy of organization-wide risk management.9
Security-related information pertaining to a system component inventory is used to determine
compliance with CM-8 Information System Component Inventory.
Organizations
increase situational awareness through enhanced monitoring capabilities and subsequently
increase insight into and control of the processes used to manage organizational security.
Increased insight into and control of security processes in turn enhances situational awareness.
Therefore, the process of implementing ISCM is recursive. ISCM informs and is informed by
distinct organizational security processes and associated requirements for input and output of
security-related information. Consider the following example:
This example illustrates how data collected in assessing a security control is leveraged to
calculate a metric and provide input into various organizational processes. It further illustrates
that a problem, once detected, can trigger an assessment of one or more controls across an
organization, updates to relevant security-related information, modifications to the organizational
security program plan and security processes, and improved compliance to the security program
and applicable system security plan. The end result is improved organization-wide risk
management and continual improvement limited only by the speed with which the organization
can collect information and respond to findings.
The information is assessed
to determine whether or not the control is effective, (i.e., if the inventory is accurate). If found to
be inaccurate, an analysis to determine the root cause of the inaccuracy is initiated (e.g., perhaps a
process for connecting components to the network has been ignored or is out of date, asset
management tools are not operating as expected, or the organization is under attack). Based on
the analysis, responses are initiated as appropriate (e.g., responsible parties update inventory,
update relevant organizational processes, train employees, disconnect errant devices, etc.).
Additionally, security-related information pertaining to a system component inventory may be
used to support predefined metrics. More accurate system component inventories support
improved effectiveness of other security domains such as patch management and vulnerability
management.