Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Discussion: The results of monitoring activities are documented and reported to the authorizing official
and other selected organizational officials on an ongoing basis in accordance with the organizational
continuous monitoring strategy. Other organizational officials who may receive security and privacy
posture reports include, for example, chief information officer, senior agency information security officer,
senior agency official for privacy, senior accountable official for risk management or risk executive
(function), information owner or steward, incident response roles, and contingency planning roles.
Security and privacy posture reporting can be event-driven, time-driven, or event- and time-driven.110 The
reports provide the authorizing official and other organizational officials with information regarding the
security and privacy posture of the systems including the effectiveness of implemented controls. Security
and privacy posture reports describe the ongoing monitoring activities employed by system owners or
common control providers. The reports also include information about security and privacy risks in the
systems and environments of operation discovered during control assessments, auditing, and continuous
monitoring and how system owners or common control providers plan to address those risks.
Organizations have flexibility in the breadth, depth, formality, form, and format of security and privacy
posture reports. The goal is efficient ongoing communication with the authorizing official and other
organizational officials as necessary, conveying the current security and privacy posture of systems and
environments of operation and how the current posture affects individuals, organizational missions, and
business functions. At a minimum, security and privacy posture reports summarize changes to the security
and privacy plans, security and privacy assessment reports, and plans of action and milestones that have
occurred since the last report. The use of automated security and privacy management and reporting
tools (e.g., a dashboard) by the organization facilitates the effectiveness and timeliness of security and
privacy posture reporting.
The frequency of security and privacy posture reports is at the discretion of the organization and in
compliance with federal and organizational policies. Reports occur at appropriate intervals to transmit
security and privacy information about systems or common controls but not so frequently as to generate
unnecessary work or expense. Authorizing officials use the security and privacy posture reports and
consult with the senior accountable official for risk management or risk executive (function), senior
agency information security officer, and senior agency official for privacy to determine if a reauthorization
action is necessary.
Security and privacy posture reports are marked, protected, and handled in accordance with federal and
organizational policies. Security and privacy posture reports can be used to satisfy FISMA reporting
requirements for documenting remediation actions for security and privacy weaknesses or deficiencies.
Reporting on security and privacy posture is intended to be ongoing and should not be interpreted as
requiring the time, expense, and formality associated with the information provided for the initial
authorization. Rather, reporting is conducted in a cost-effective manner consistent with achieving the
reporting objectives.
References: [SP 800-53A]; [SP 800-137]; [NIST CSF] (Core [Identify, Protect, Detect, Respond, Recover
Functions]).