NIST-CA-7 Continuous Monitoring

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monitored: [Assignment: system-level metrics]; b. Establishing [Assignment: frequencies] for monitoring and [Assignment: frequencies] for assessment of control effectiveness; c. Ongoing control assessments in accordance with the continuous monitoring strategy; d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e. Correlation and analysis of information generated by control assessments and monitoring; f. Response actions to address results of the analysis of control assessment and monitoring information; and g. Reporting the security and privacy status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring generate risk response actions by organizations. When monitoring the effectiveness of multiple controls that have been grouped into capabilities, a root-cause analysis may be needed to determine the specific control that has failed. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security and privacy information on a continuing basis through reports and dashboards gives organizational officials the ability to make effective and timely risk management decisions, including ongoing authorization decisions. Automation supports more frequent updates to hardware, software, and firmware inventories, authorization packages, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of systems. Monitoring requirements, including the need for specific monitoring, may be referenced in other controls and control enhancements, such as [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PM-31](#pm-31), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SR-4](#sr-4), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) , and [SI-4](#si-4).

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1008 Fallback Channels • T1021.002 SMB/Windows Admin Shares • T1021.005 VNC • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1036 Masquerading • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.007 Double File Extension • T1037 Boot or Logon Initialization Scripts • T1037.002 Login Hook • T1037.003 Network Logon Script • T1037.004 RC Scripts • T1037.005 Startup Items • T1041 Exfiltration Over C2 Channel • T1046 Network Service Discovery • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053.006 Systemd Timers • T1055.009 Proc Memory • T1056.002 GUI Input Capture • T1059 Command and Scripting Interpreter • T1059.005 Visual Basic • T1059.007 JavaScript • T1059.010 AutoHotKey & AutoIT • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1080 Taint Shared Content • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1090.003 Multi-hop Proxy • T1095 Non-Application Layer Protocol • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1111 Multi-Factor Authentication Interception • T1132 Data Encoding • T1132.001 Standard Encoding • T1132.002 Non-Standard Encoding • T1176 Browser Extensions • T1185 Browser Session Hijacking • T1187 Forced Authentication • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1197 BITS Jobs • T1201 Password Policy Discovery • T1203 Exploitation for Client Execution • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1205 Traffic Signaling • T1205.001 Port Knocking • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.002 Control Panel • T1218.010 Regsvr32 • T1218.011 Rundll32 • T1218.012 Verclsid • T1218.015 Electron Applications • T1219 Remote Access Software • T1221 Template Injection • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1489 Service Stop • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1539 Steal Web Session Cookie • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1543.002 Systemd Service • T1546.003 Windows Management Instrumentation Event Subscription • T1546.004 Unix Shell Configuration Modification • T1546.013 PowerShell Profile • T1546.016 Installer Packages • T1547.003 Time Providers • T1547.013 XDG Autostart Entries • T1548 Abuse Elevation Control Mechanism • T1548.003 Sudo and Sudo Caching • T1548.006 TCC Manipulation • T1550.003 Pass the Ticket • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1552.005 Cloud Instance Metadata API … and 60 more