Navigate

SA-4(8)

SA-4(8): Continuous Monitoring Plan

The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains [organization-defined level of detail].

Supplemental

The objective of continuous monitoring plans is to determine if the complete set of planned, required, and deployed security controls within the information system, system component, or information system service continue to be effective over time based on the inevitable changes that occur. Developer continuous monitoring plans include a sufficient level of detail such that the information can be incorporated into the continuous monitoring strategies and programs implemented by organizations.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-4(8).

Control	Description
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].

Control

Description

CA-7

The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

a: Establishment of [organization-defined metrics] to be monitored;

b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring;

c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

e: Correlation and analysis of security-related information generated by assessments and monitoring;

f: Response actions to address results of the analysis of security-related information; and

g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of SA-4(8).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-4(8).

CCI	Definition
CCI-003112	Require the developer of the system, system component, or system service to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
CCI-003113	The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.