03.12.03: Continuous Monitoring
Control Family:
CSF v1.1 References:
CSF v2.0 References:
Previous Version:
- NIST Special Publication 800-171 Revision 2:
- 3.12.3: Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls
Incorporates the following control from the previous version of the control set: 3.4.9: Control and monitor user-installed software.
Requirements
- Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.
Discussion
Continuous monitoring at the system level facilitates ongoing awareness of the system security posture to support risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk-based decisions. Different types of security requirements may require different monitoring frequencies.