ComplianceNIST 800-53 control

NIST-PM-31 Continuous Monitoring Strategy

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
PM Program Management
Control
PM-31

Control statement

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignment: metrics]; b. Establishing [Assignment: monitoring frequencies] and [Assignment: assessment frequencies] for control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

Discussion

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CA-7](#ca-7), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b), [SI-4](#si-4).

Related

Related control · Compliance (50)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AT-4 Training Records NIST 800-53 control
  • NIST-AU-13 Monitoring for Information Disclosure NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-5 Plan of Action and Milestones NIST 800-53 control
  • NIST-CA-6 Authorization NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IR-5 Incident Monitoring NIST 800-53 control
  • NIST-MA-2 Controlled Maintenance NIST 800-53 control
  • NIST-MA-3 Maintenance Tools NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-PE-14 Environmental Controls NIST 800-53 control
  • NIST-PE-16 Delivery and Removal NIST 800-53 control
  • NIST-PE-20 Asset Monitoring and Tracking NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-6 Monitoring Physical Access NIST 800-53 control
  • NIST-PL-2 System Security and Privacy Plans NIST 800-53 control
  • NIST-PM-10 Authorization Process NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
  • NIST-PM-14 Testing, Training, and Monitoring NIST 800-53 control
  • NIST-PM-23 Data Governance Body NIST 800-53 control
  • NIST-PM-28 Risk Framing NIST 800-53 control
Show all 50 ›

Referenced by Compliance · has member (1)

  • NIST-PM Program Management NIST 800-53 family

Referenced by Compliance · related control (2)

  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control