Navigate

CA-7

CA-7: Continuous Monitoring

The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

a: Establishment of [organization-defined metrics] to be monitored;

b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring;

c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

e: Correlation and analysis of security-related information generated by assessments and monitoring;

f: Response actions to address results of the analysis of security-related information; and

g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].

Supplemental

Continuous monitoring programs facilitate ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess/analyze security controls and information security-related risks at a frequency sufficient to support organizational risk-based decisions. The results of continuous monitoring programs generate appropriate risk response actions by organizations. Continuous monitoring programs also allow organizations to maintain the security authorizations of information systems and common controls over time in highly dynamic environments of operation with changing mission/business needs, threats, vulnerabilities, and technologies. Having access to security-related information on a continuing basis through reports/dashboards gives organizational officials the capability to make more effective and timely risk management decisions, including ongoing security authorization decisions. Automation supports more frequent updates to security authorization packages, hardware/software/firmware inventories, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of information systems.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Privacy (CNSSI 1253), Privacy (High), Privacy (Mod), Privacy (PHI)

CSF Categories
DE.AE-2, DE.AE-3, DE.CM-1, DE.CM-2, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-1, DE.DP-2, DE.DP-3, DE.DP-4, DE.DP-5, ID.RA-1, PR.IP-7, PR.IP-8, RS.AN-1, RS.CO-3, RS.MI-3

Related Controls

The controls below (if any) were marked by NIST as being related to CA-7.

Control	Description
CA-2	The organization: a: Develops a security assessment plan that describes the scope of the assessment including: 1: Security controls and control enhancements under assessment; 2: Assessment procedures to be used to determine security control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; c: Produces a security assessment report that documents the results of the assessment; and d: Provides the results of the security control assessment to [organization-defined individuals or roles].
CA-5	The organization: a: Develops a plan of action and milestones for the information system to document the organization’s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and b: Updates existing plan of action and milestones [organization-defined frequency] based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.
CA-6	The organization: a: Assigns a senior-level executive or manager as the authorizing official for the information system; b: Ensures that the authorizing official authorizes the information system for processing before commencing operations; and c: Updates the security authorization [organization-defined frequency].
CM-3	The organization: a: Determines the types of changes to the information system that are configuration-controlled; b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; c: Documents configuration change decisions associated with the information system; d: Implements approved configuration-controlled changes to the information system; e: Retains records of configuration-controlled changes to the information system for [organization-defined time period]; f: Audits and reviews activities associated with configuration-controlled changes to the information system; and g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
PM-6	The organization develops, monitors, and reports on the results of information security measures of performance.
PM-9	The organization: a: Develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems; b: Implements the risk management strategy consistently across the organization; and c: Reviews and updates the risk management strategy [organization-defined frequency] or as required, to address organizational changes.
RA-5	The organization: a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1: Enumerating platforms, software flaws, and improper configurations; 2: Formatting checklists and test procedures; and 3: Measuring vulnerability impact; c: Analyzes vulnerability scan reports and results from security control assessments; d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
SA-11	The organization requires the developer of the information system, system component, or information system service to: a: Create and implement a security assessment plan; b: Perform [one or more of unit/integration/system/regression] testing/evaluation at [organization-defined depth and coverage]; c: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation; d: Implement a verifiable flaw remediation process; and e: Correct flaws identified during security testing/evaluation.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SI-2	The organization: a: Identifies, reports, and corrects information system flaws; b: Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c: Installs security-relevant software and firmware updates within [organization-defined time period] of the release of the updates; and d: Incorporates flaw remediation into the organizational configuration management process.
SI-4	The organization: a: Monitors the information system to detect: 1: Attacks and indicators of potential attacks in accordance with [organization-defined monitoring objectives]; and 2: Unauthorized local, network, and remote connections; b: Identifies unauthorized use of the information system through [organization-defined techniques and methods]; c: Deploys monitoring devices: 1: Strategically within the information system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g: Provides [organization-defined information system monitoring information] to [organization-defined personnel or roles] [one or more of as needed/ {{ insert: param, si-4_prm_6 }} ].

Enhancements

The controls below (if any) add on to the requirements of CA-7.

Control	Description
CA-7(1)	The organization employs assessors or assessment teams with [organization-defined level of independence] to monitor the security controls in the information system on an ongoing basis.
CA-7(2)
CA-7(3)	The organization employs trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Related CCIs

The CCIs below are tied to CA-7.

CCI	Definition
CCI-000274	Develop a continuous monitoring strategy.
CCI-000279	Implement ongoing control assessments in accordance with the continuous monitoring strategy.
CCI-000280	Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency.
CCI-000281	Defines the frequency with which to report the security status to organization-defined personnel or roles.
CCI-001581	The organization defines personnel or roles to whom the security status of the organization and the information system should be reported.
CCI-002087	Establish organization-defined system-level metrics to be monitored.
CCI-002088	Establish organization-defined frequencies for monitoring.
CCI-002089	The organization establishes and defines the frequencies for assessments supporting continuous monitoring.
CCI-002090	Implement ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.
CCI-002091	Implement a continuous monitoring program that includes correlation and analysis of information generated by assessments and monitoring.
CCI-002092	Implement a continuous monitoring program that includes response actions to address results of the analysis of control assessment and monitoring information.