Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of > 3.6 REVIEW AND UPDATE THE MONITORING PROGRAM AND STRATEGY

3.6 REVIEW AND UPDATE THE MONITORING PROGRAM AND STRATEGY

ISCM strategies and programs are not static. Security control assessments, security status metrics,
and monitoring and assessment frequencies change in accordance with the needs of the
organization. The continuous monitoring strategy is reviewed to ensure that it sufficiently
supports the organization in operating within acceptable risk tolerance levels, that metrics remain
relevant, and that data is current and complete. The strategy review also identifies ways to
improve organizational insight into security posture, effectively supports informed risk
management decision making/ongoing authorizations, and improves the organization's ability to
respond to known and emerging threats.
The organization establishes a procedure for reviewing and modifying all aspects of the ISCM
strategy, including relevance of the overall strategy, accuracy in reflecting organizational risk
tolerance, accuracy/correctness of measurements, and applicability of metrics, reporting
requirements, and monitoring and assessment frequencies. If any of the data collected is not
required for reporting purposes or found to be not useful in maintaining or improving the
organization's security posture, then the organization considers saving resources by discontinuing
that particular collection. Factors precipitating changes in the monitoring strategy may include,
but are not limited to:
•
Changes to core missions or business processes;
•
Significant changes in the enterprise architecture (including addition or removal of systems);
•
Changes in organizational risk tolerance;
•
Changes in threat information;
•
Changes in vulnerability information;
•
Changes within information systems (including changes in categorization/impact level);
•
Increase/decrease in POA&Ms related to specific controls;
42 Changes to security controls are made after being fully tested, vetted, and reviewed in a test environment.
•
Trend analyses of status reporting output;
•
New federal laws or regulations; and/or
•
Changes to reporting requirements.
Officials examine consolidated POA&M information to determine if there are common
weaknesses/deficiencies among the organization's information systems and propose or request
solutions. The aggregate POA&M information is used to allocate risk mitigation resources
organization-wide and to make adjustments to the monitoring strategy. Similarly, status reports
and metrics are analyzed to determine if there are any security trends that suggest changes to the
monitoring strategy may be necessary. For instance, if weekly assessments of component
inventories over a six-month period indicate that very few changes are being made in a given
week and changes that were made are accurately reflected in the inventories, the organization
may wish to reduce the frequency of monitoring component inventories to biweekly or monthly.
Conversely, if biweekly audit record analyses over a six-month period indicate increases in
anomalous events, the organization may wish to increase the frequency of audit record reviews to
weekly.
An organization's ISCM strategy also changes as the organization's security program(s) and
monitoring capabilities mature. In a fully mature program, security-related information collection
and analysis are accomplished using standardized methods across the organization, as an integral
part of mission and business processes, and automated to the fullest extent possible. In this case,
the security program is mature enough to ensure that sufficient processes and procedures
effectively secure the enterprise architecture in accordance with organizational risk tolerances,
and to collect, correlate, analyze, and report on relevant security metrics.43
ISCM is a recursive process in the sense that the monitoring strategy is continually refined as the
steps of the process repeat. Further, the organization-wide application of ISCM is accomplished
through smaller or more narrowly focused instances of the similar efforts at the mission/business
processes and systems tiers. In other words, the output of ISCM at Tier 3 is input to the
implementation of the ISCM programs at Tiers 1 and 2. Working from the top of the pyramid in
Figure 2-1 (Tier 1) to its bottom (Tier 3), upper-tier monitoring strategies set the parameters for
lower-tier monitoring programs, and observations made at the lower tiers may result in changes to
upper-tier monitoring strategies. The ISCM program itself must be monitored so that it can
evolve with changes in organizational missions and objectives, operational environments, and
threats.
Primary Roles: Senior Information Security Officer, Authorizing Official, Information System
Owner/Common Control Provider
Supporting Roles: Risk Executive (Function), Chief Information Officer, Information System
Security Officer
Expected Input: Trend analyses from existing monitoring; organizational risk tolerance
information; information on new laws, regulations, reporting requirements; current threat and
vulnerability information; other organizational information as required, updates to automation
specifications
43 See NIST SP 800-55, as amended, for more information on security metrics.
Expected Output: Revised ISCM strategy or a brief documented report noting review details and
that modifications to the strategy were not necessary (in accordance with the established review
process)