Continuous Monitoring
The process implemented to maintain a current security status for one or more information systems or for the entire suite of information systems on which the operational mission of the enterprise depends. The process includes: 1) The development of a strategy to regularly evaluate selected IA controls/metrics, 2) Recording and evaluating IA relevant events and the effectiveness of the enterprise in dealing with those events, 3) Recording changes to IA controls, or changes that affect IA risks, and 4) Publishing the current security status to enable information-sharing decisions involving the enterprise.
Senses
The purpose of this task is to maintain ongoing awareness of information security, vulnerabilities, and threats in order to support organizational risk decisions and to assess, analyze, and report on security controls and organizational risks at a frequency that sufficiently supports risk-based security decisions and adequately protects an organization's information.
Maintaining ongoing awareness to support organizational risk decisions.
No definition is given in NIST SP 800-171r3. The term is attested in use at 5 citations in that document; a definition is pending curation.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- Continuous Monitorings
- possessive
- Continuous Monitoring's
- pluralpossessive
- Continuous Monitorings'