Continuous Monitoring Strategy

LOW MODERATE HIGH

1 Overlay 50 Related Controls

Requirements NIST SOURCE

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:

Discussion (NIST Supplemental Guidance)

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, AC-2g, AC-2(7), AC-2(12)(a), AC-2(7)(b), AC-2(7)(c), AC-17(1), AT-4a, AU-13, AU-13(1), AU-13(2), CA-7, CM-3f, CM-6d, CM-11c, IR-5, MA-2b, MA-3a, MA-4a, PE-3d, PE-6, PE-14b, PE-16, PE-20, PM-6, PM-23, PS-7e, SA-9c, SC-5(3)(b), SC-7a, SC-7(24)(b), SC-18b, SC-43b, SI-4.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PM-31 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

the metrics for organization-wide continuous monitoring are defined;
the frequency for monitoring is defined;
the frequency for assessing control effectiveness is defined;
the personnel or roles for reporting the security status of organizational systems to is/are defined;
the personnel or roles for reporting the privacy status of organizational systems to is/are defined;
the frequency at which to report the security status of organizational systems is defined;
the frequency at which to report the privacy status of organizational systems is defined;
an organization-wide continuous monitoring strategy is developed;
continuous monitoring programs are implemented that include establishing <PM-31_ODP[01] metrics> to be monitored;
continuous monitoring programs are implemented that establish <PM-31_ODP[02] frequency> for monitoring;
continuous monitoring programs are implemented that establish <PM-31_ODP[03] frequency> for assessment of control effectiveness;
continuous monitoring programs are implemented that include monitoring <PM-31_ODP[01] metrics> on an ongoing basis in accordance with the continuous monitoring strategy;
continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
continuous monitoring programs are implemented that include reporting the security status of organizational systems to <PM-31_ODP[04] personnel or roles> <PM-31_ODP[06] frequency>;
continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to <PM-31_ODP[05] personnel or roles> <PM-31_ODP[07] frequency>.

Examine

[SELECT FROM: Information security program plan; privacy program plan; supply chain risk management plan; continuous monitoring strategy; risk management strategy; information security continuous monitoring program documentation, reporting, metrics, and artifacts; information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts; assessment and authorization policy; procedures addressing the continuous monitoring of controls; privacy program continuous monitoring documentation, reporting, metrics, and artifacts; continuous monitoring program records, security, and privacy impact analyses; status reports; risk response documentation; other relevant documents or records.].

Interview

[SELECT FROM: Senior Accountable Official for Risk Management; chief information officer; senior agency information security officer; senior agency official for privacy; organizational personnel with information security, privacy, and supply chain risk management program responsibilities].

Test

[SELECT FROM: Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

Base control: Added (beyond standard baseline)

HIGH

Not applicable at this tier.

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PM-31. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Information security program plan
privacy program plan
supply chain risk management plan
continuous monitoring strategy
risk management strategy
information security continuous monitoring program documentation, reporting, metrics, and artifacts
information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts
assessment and authorization policy
privacy program continuous monitoring documentation, reporting, metrics, and artifacts
continuous monitoring program records, security, and privacy impact analyses

Testing

Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring

Other Records

procedures addressing the continuous monitoring of controls
status reports
risk response documentation
other relevant documents or records