Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER ONE > INTRODUCTION

INTRODUCTION

nformation security continuous monitoring (ISCM) is defined as maintaining ongoing
awareness of information security, vulnerabilities, and threats to support organizational risk
management decisions. 2 This publication specifically addresses assessment and analysis of
security control effectiveness and of organizational security status in accordance with
organizational risk tolerance. Security control effectiveness is measured by correctness of
implementation and by how adequately the implemented controls meet organizational needs in
accordance with current risk tolerance (i.e., is the control implemented in accordance with the
security plan to address threats and is the security plan adequate).3
•
Maintaining situational awareness of all systems across the organization;
Organizational security status
is determined using metrics established by the organization to best convey the security posture of
an organization's information and information systems, along with organizational resilience given
known threat information. This necessitates:
•
Maintaining an understanding of threats and threat activities;
•
Assessing all security controls;
•
Collecting, correlating, and analyzing security-related information;
•
Providing actionable communication of security status across all tiers of the organization;
and
•
Active management of risk by organizational officials.
Communication with all stakeholders is key in developing the strategy and implementing the
program. This document builds on the monitoring concepts introduced in NIST SP 800-37 Rev.
1, Guide for Applying the Risk Management Framework to Federal Information Systems: A
Security Life Cycle Approach. An ISCM program helps to ensure that deployed security controls
continue to be effective and that operations remain within stated organizational risk tolerances in
light of the inevitable changes that occur over time. In cases where security controls are
determined to be inadequate, ISCM programs facilitate prioritized security response actions based
on risk.
An ISCM strategy is meaningful only within the context of broader organizational needs,
objectives, or strategies, and as part of a broader risk management strategy, enabling timely
The terms "continuous" and "ongoing" in this context mean that security controls and organizational risks are
assessed and analyzed at a frequency sufficient to support risk-based security decisions to adequately protect
organization information. Data collection, no matter how frequent, is performed at discrete intervals.
NIST SP 800-53A, as amended, defines security control effectiveness as "the extent to which the controls are
implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the
security requirements for the system."
management, assessment, and response to emerging security issues. Information collected
through the ISCM program supports ongoing authorization decisions.4
ISCM, a critical step in an organization's Risk Management Framework (RMF), gives
organizational officials access to security-related information on demand, enabling timely risk
management decisions, including authorization decisions. Frequent updates to security plans,
security assessment reports, plans of action and milestones, hardware and software inventories,
and other system information are also supported. ISCM is most effective when automated
mechanisms are employed where possible for data collection and reporting. Effectiveness is
further enhanced when the output is formatted to provide information that is specific, measurable,
actionable, relevant, and timely. While this document encourages the use of automation, it is
recognized that many aspects of ISCM programs are not easily automated.