CCI-002086

Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Implementation Guidance

Determine if: - trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data. - trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data. - trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Validation Procedures

Examine: [SELECT FROM: Organizational continuous monitoring strategy; system-level continuous monitoring strategy; assessment, authorization, and monitoring policy; procedures addressing continuous monitoring of system controls; privacy controls; assessment report; plan of action and milestones; system monitoring records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with continuous monitoring responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Mechanisms supporting trend analyses].

The controls below (if any) were marked by NIST as being related to CCI-002086.