Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER TWO > 2.1 ORGANIZATION-WIDE VIEW OF ISCM

2.1 ORGANIZATION-WIDE VIEW OF ISCM

Maintaining an up-to-date view of information security risks across an organization is a complex,
multifaceted undertaking. It requires the involvement of the entire organization, from senior
leaders providing governance and strategic vision to individuals developing, implementing, and
operating individual information systems in support of the organization's core missions and
business functions. Figure 2-1 illustrates a tiered approach to organization-wide ISCM in support
of risk management. Tier 1 governance, risk management goals, and organizational risk tolerance
drive the ISCM strategy. Organizational risk tolerance established by senior executives/leaders as
part of the risk executive (function)11
ISCM is discussed within the larger context of organization-wide risk management in NIST SP 800-39.
influences ISCM policy, procedures, and implementation
activities across all tiers. Data collection primarily occurs at the information systems tier. Metrics
are designed to present information in a context that is meaningful for each tier. For example,
ISCM data collected at Tier 3 may be aggregated to provide security status or risk scores for a
single system, for a collection of systems, across a core business process, or for the entire
organization. Policies, procedures, and tools may be established at any tier; however, when
10 CM-8 is a security control from the Configuration Management family in NIST SP 800-53, Appendix F.
11 See Section 2.4 for a discussion of roles and responsibilities of the risk executive (function).
established at Tiers 1 or 2, they facilitate the consistent implementation of ISCM across the
organization and better support data reuse and judicious use of resources. Data collection,
analysis, and reporting are automated where possible.12 Through the use of automation, it is
possible to monitor a greater number of security metrics with fewer resources, higher frequencies,
larger sample sizes,13
12 Care must be taken in determining how best to use security-related information from individual information
systems in calculating organizational metrics for security and risk. Dashboards and metrics, designed to provide
organizational situational awareness of security and risk, can provide a false sense of security if used without
continued assurance of the relevance of the metrics.
and with greater consistency and reliability than is feasible using manual
processes. Organizations regularly review the ISCM strategy to ensure that metrics continue to be
relevant, meaningful, actionable, and supportive of risk management decisions made by
organizational officials at all tiers.
13 If an organization does not have the resources or infrastructure necessary to assess every relevant object within its
information infrastructure, sampling is an approach that may be useful in reducing the level of effort associated
with continuous monitoring. Additional information is provided in Section 3.1.4.
Figure 2-1. Organization-wide ISCM
An organization-wide approach to continuous monitoring of information and information system
security supports risk-related decision making at the organization level (Tier 1), the
mission/business processes level (Tier 2), and the information systems level (Tier 3).14