The text of the Information Security Continuous Monitoring (ISCM) Strategy
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year.
Mandate. National Institute of Standards and Technology (NIST) SP 800-53 CA-7 requires a continuous monitoring strategy that defines metrics, monitoring and assessment frequencies, and response actions. NIST SP 800-137 defines the ISCM process. Office of Management and Budget (OMB) Circular A-130 requires ongoing awareness of security posture to support risk decisions.
1. Strategy #
The Organization monitors security posture continuously at three tiers: organization, mission and business process, and system (NIST SP 800-39). Authorizing Officials then base their decisions on current information, not on a point-in-time assessment. Monitoring outputs feed the performance measures defined in each family policy, the plan of action and milestones (POA&M) process (PROC-POAM-001), and Authorizing Official reporting.
Each process below names the person who acts, the action, the tool, the record it leaves, and the NIST SP 800-53 controls it supports. POA&M items and ongoing authorization records live in the governance, risk, and compliance (GRC) system. Remediation tickets live in the ticketing system.
2. Monitoring Domains, Metrics, and Frequencies #
| Domain | What is monitored | Frequency | Tool |
|---|---|---|---|
| Vulnerability management | Detection and authenticated coverage; findings against their due dates (Binding Operational Directive (BOD) 26-04 Table 1 and RA-5 timeframes); Known Exploited Vulnerabilities (KEV) due dates | Continuous agent detection; weekly authenticated scans of assets without an agent; KEV additions matched on publication | The vulnerability scanner |
| Configuration management | Baseline compliance; drift; unauthorized software and components | Continuous agent reporting; monthly reconciliation | Configuration compliance scans, with the asset inventory tool |
| Identity and access | Account lifecycle events; privileged activations; inactivity; access review completion | Continuous; monthly rollup | The identity provider |
| Event monitoring | The OMB M-26-14 minimum logging baseline (identity, network, object access, privilege changes, infrastructure changes, security tooling, indicators of compromise, anomalies); correlation alerts; log source health | Continuous; 24-hour log-source heartbeat | The security information and event management (SIEM) system |
| Endpoint security | endpoint detection and response (EDR) coverage and signal health (OMB M-22-01) | Continuous; monthly coverage reconciliation | The EDR tools |
| Control assessment | Rotational assessment of controls under the assessment schedule | On the continuous monitoring schedule (all controls within the authorization cycle) | The GRC system |
Monitoring and assessment technology:
(No technology inventory entries for this family.)
2.1 Collecting and Analyzing Monitoring Data #
Entry criteria: A system holds an authorization, or it is being assessed for one.
Exit criteria: Each result is compared with its threshold, and the results are recorded for the system.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. The Security Operations Center (SOC) | Watch the correlation alerts and the health of each log source around the clock. Raise an alert when a source sends nothing for 24 hours. | The SIEM system | Alert queue and log-source report | SI-04, AU-06 |
| 2. Vulnerability management team | Keep agent detection running on every asset that can run an agent. Run weekly authenticated scans of the assets that cannot. | The vulnerability scanner | Scan results and coverage report | RA-05, CA-07 |
| 3. Vulnerability management team | Match each new KEV entry against the asset findings on the day the Cybersecurity and Infrastructure Security Agency (CISA) publishes it. Set each finding’s due date. | The vulnerability scanner | KEV match results | RA-05, SI-02 |
| 4. Endpoint team | Confirm that every endpoint reports to the EDR tools. Each month, reconcile endpoint coverage against the asset inventory. | The EDR tool | Coverage reconciliation | SI-03, SI-04, CM-08 |
| 5. System administrators | Run configuration compliance scans against the approved baselines. Each month, reconcile drift and unauthorized software. | The vulnerability scanner | Baseline compliance report | CM-06, CM-07, CM-08 |
| 6. Identity and access management lead | Report account lifecycle events, privileged activations, inactive accounts, and access review completion. Roll the results up each month. | The identity provider | Account reports and review records | AC-02, AC-06 |
| 7. Information System Security Officer (ISSO) | Compare each result with its threshold in the family policy. Record the results for the system. | The GRC system | System monitoring results | CA-07, PM-31 |
Evidence: the alert queue and log-source reports, the scan, KEV, coverage, and baseline reports, the account reports, and the system monitoring results in the GRC system.
3. Assessment Frequencies #
Controls are assessed on a rotational schedule such that every implemented control is assessed within the authorization cycle. Volatile controls (vulnerability, configuration, and account management) are assessed at least once a year, and automated-evidence controls are evaluated continuously. Assessment results update the System Security and Privacy Plan (SSPP), the security assessment report, and the POA&M.
Each annual assessment adds two groups of controls to the ones the rotation schedules for that year:
- every control whose POA&M item closed since the last assessment, so the assessor confirms the fix works;
- every control linked to an audit finding or an incident in the past year.
3.1 Common Controls #
The Security Control Assessor assesses the common controls, and the common part of each hybrid control, on the same rotation as system controls. The rotation reaches every common control within its authorization period. The Authorizing Official for common controls authorizes them in writing. The Common Control Provider keeps a POA&M item for each weak common control. The Common Control Provider sends a status report on the common controls to the Authorizing Official of each inheriting system. The report goes before that system’s authorization decision and [CA-07 parameter 5 — to be defined] after that.
3.2 Privacy Controls #
For each system that processes personally identifiable information (PII), the Privacy Continuous Monitoring Strategy sets how often privacy controls are assessed. The Senior Agency Official for Privacy (SAOP) owns that strategy, as OMB Circular A-130 requires. The ISSO sends the results for privacy controls to the SAOP. The CISO tells the SAOP about any monitoring finding that puts PII at risk.
4. Respond to Monitoring Results #
When a monitoring result falls outside its defined threshold, these steps follow in order.
Entry criteria: A monitoring result falls outside its threshold.
Exit criteria: The condition is corrected, or a ticket or POA&M item tracks it.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. Administrator | Correct the condition through automation where the correction is safe. | The tool that found it | Automated correction log | CA-07, SI-02 |
| 2. ISSO | Open a ticket for the responsible owner, with the timeline from the relevant policy. | The ticketing system | Remediation ticket | CA-07 |
| 3. ISSO | When the owner cannot meet that timeline, enter a POA&M item. | The GRC system | Open item | CA-05, CA-07 |
| 4. ISSO | Escalate to the CISO and the Authorizing Official as the POA&M Management Procedure directs. | The GRC system | Escalation record | CA-05, PM-09 |
Evidence: the remediation tickets in the ticketing system, and the open items and escalation records in the GRC system.
5. Security Status Reports #
The ISSO prepares a security status report for each system [CA-07 parameter 5 — to be defined], and after each annual assessment. The ISSO sends it to the Authorizing Official and the CISO. The report covers:
- the assessment results since the last report;
- the risks carried forward from earlier reports;
- open vulnerabilities by severity;
- POA&M progress, with the items past their scheduled completion dates;
- the risks proposed for the Authorizing Official to accept;
- whether the system’s security posture is improving or getting worse.
The Authorizing Official signs the report to accept the residual risk it states, or directs further action. The CISO uses the reports in the enterprise risk review.
Entry criteria: A report is due, or an annual assessment is complete.
Exit criteria: The Authorizing Official signed the report or directed further action.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. ISSO | Draw the assessment results, open vulnerabilities, and open items for the system. | The GRC system | Report data | CA-07 |
| 2. ISSO | Write the security status report with the contents listed above. Send it to the Authorizing Official and the CISO. | The GRC system | Security status report | CA-07, CA-06 |
| 3. Authorizing Official | Sign the report to accept the residual risk it states, or direct further action. | The GRC system | Signed report | CA-06, CA-07 |
| 4. CISO | Use the reports in the enterprise risk review. | The document management system | Risk review minutes | PM-09 |
Evidence: the signed security status reports in the GRC system.
6. Ongoing Authorization #
OMB Circular A-130 Appendix I and NIST SP 800-37 Rev 2 Appendix F allow a system to move from time-based reauthorization to ongoing authorization. A system or a set of common controls may enter ongoing authorization only when all of these are true:
- It holds a current initial authorization.
- The continuous monitoring program monitors all of its implemented controls at the frequencies this strategy sets, and gives the Authorizing Official current results.
- For a system that processes PII, the SAOP confirms that the privacy continuous monitoring program covers it.
The Authorizing Official decides whether the system enters ongoing authorization. The ISSO gives the Authorizing Official the current authorization package, the monitoring results, and the open POA&M items. The Authorizing Official signs a written decision that the system is managed under ongoing authorization and accepts responsibility for the monitoring it needs, as A-130 requires. The ISSO records the system’s ongoing authorization status in the system inventory in the GRC system.
The Authorizing Official reviews each system under ongoing authorization each time a security status report arrives, [CA-07 parameter 5 — to be defined]. At each review, the Authorizing Official confirms the authorization or directs further action. The Authorizing Official returns the system to time-based reauthorization when monitoring no longer covers its controls at the set frequencies. The same applies when the results no longer support a risk decision. An event that drives risk above the Organization’s tolerance calls for an event-driven reauthorization. The ISSO records each change of status in the GRC system.
Entry criteria: A system holds a current initial authorization, and its System Owner asks for ongoing authorization.
Exit criteria: The Authorizing Official signed a decision, and the system inventory shows the status.
| Step and actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| 1. ISSO | Confirm the system meets every entry condition. Send the Authorizing Official the current authorization package, the monitoring results, and the open items. | The GRC system | Ongoing authorization request | CA-06, CA-07 |
| 2. SAOP | For a system that processes PII, confirm the privacy continuous monitoring program covers it. | The GRC system | SAOP confirmation | CA-06, PM-31 |
| 3. Authorizing Official | Decide whether the system enters ongoing authorization. Sign the written decision. | The GRC system | Signed decision | CA-06 |
| 4. ISSO | Record the system’s ongoing authorization status in the system inventory. | The GRC system | Status in the system inventory | CA-06, PM-05 |
| 5. Authorizing Official | At each security status report, confirm the authorization, direct further action, or return the system to time-based reauthorization. | The GRC system | Review record | CA-06, CA-07 |
| 6. ISSO | Record each change of status. | The GRC system | Status history | CA-06 |
Evidence: the signed ongoing authorization decision, the review records, and the status history in the GRC system.
7. Roles #
The CISO owns this strategy and its metrics. ISSOs operate system-level monitoring and respond to findings. The SOC operates event monitoring. System Owners resource remediation. The Common Control Provider monitors and reports on common controls. The SAOP owns privacy continuous monitoring. The Authorizing Official uses monitoring reporting for authorization decisions.
8. References #
These are the sources this document cites, with a link to each official text.
- NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
- NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
- OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
- OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.