Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
2 (3) requires that the system automatically disable accounts after a specified time period of

2 (3) requires that the system automatically disable accounts after a specified time period of

inactivity. As an automated control and one with typically high volatility, AC-2 (3) is a candidate
for relatively frequent monitoring and also may serve to automate some of the base control
requirements so that they can be monitored more frequently in accordance with the organizational
ISCM strategy.
Organization and Mission/Business Processes Tiers.
At the mission/business processes tier, the organization establishes the minimum frequency with
which each security control or metric is to be assessed or monitored. Frequencies are established
across all organizational systems and common controls based on the criteria described above in
this section. Common, hybrid, and system-specific security controls are addressed by
organization and mission/business processes tier policy and procedures. Common controls are
often inherited by a large number of organizational systems. The aggregate criticality of such
controls may require more frequent assessments than would similar controls responsible for
protecting a single system. Additionally, determining the frequency for assessing common
controls includes the organization's determination of the trustworthiness of the common control
provider. Common controls that are process-related (e.g., procedures/templates, PM controls) do
not tend to be volatile and typically do not lend themselves well to automation. Still, the
organization considers the volatility of such controls as well as related threat information when
establishing assessment frequencies.
Primary Roles: Chief Information Officer, Senior Information Security Officer
Supporting Roles: Risk Executive (Function), Authorizing Officials, Common Control Provider,
Information System Owner
Expected Input: Organizational risk assessment, organizational risk tolerance, current threat
information, reporting requirements, current vulnerability information, output from monitoring
strategy reviews
Expected Output: Organization-wide policies and procedures, recommended frequencies with
which each security control and metric is assessed or monitored
Information Systems Tier.
At the information systems tier, system owners review the minimum monitoring/assessment
frequencies established by organization and/or mission/business processes tier policy and
determine if the minimum frequencies are adequate for a given information system. For some
information systems, it may be necessary to assess specific controls or metrics with greater
frequency than prescribed by the organization, again based on the criteria described above in this
section. System owners also consider identification of specific system components that may
require more frequent monitoring than other system components (e.g., public-facing servers,
boundary protection devices, components deemed critical in the Business Impact Analysis).
Primary Roles: Information System Owner, Information System Security Officer
Supporting Roles: Authorizing Official, Senior Information Security Officer, Information
Owner/Steward
Expected Input: Organizational strategy and procedures with minimum frequencies, current
threat information, reporting requirements, current vulnerability information, output from
monitoring strategy reviews, security assessment plans
Expected Output: Security assessment plans updated to reflect the frequency with which each
system-specific security control is assessed and metrics are monitored
Event-Driven Assessments.
Events may occur that trigger the immediate need to assess security controls or verify security
status outside of requirements expressed in the ISCM strategy. This may require an assessment
that is unplanned, but of the type defined in the ISCM strategy or a customized assessment
tailored to address an emerging need (e.g., a change in planned assessment or monitoring
frequency). For example, if a Web application is added to a system, an existing ISCM process
that includes configuration management and control, SIA, developmental vulnerability scans,
etc., may be sufficient to assess controls implemented for the new Web application.
When defining criteria for event-driven assessments, organizations consider events such as
incidents, new threat information, significant changes to systems and operating environments,
new or additional mission responsibilities, and results of a security impact analysis (SIA) or
assessment of risk.
Depending on the significance of the event, an event-driven assessment may trigger one or more
system reauthorizations.
Primary Roles: Information System Owner/Common Control Provider, Authorizing Official,
Information System Security Officer
Supporting Roles: Risk Executive (Function), Senior Information Security Officer, Security
Control Assessor
Expected Input: Organizational risk assessment, organizational risk tolerance, current threat
information, current vulnerability information, organizational priorities and expectations
Expected Output: Documented criteria and thresholds for event-driven
assessments/authorizations (e.g., significant change procedures, policy and procedures on event-
driven authorizations)