Continuous Monitoring
What is Continuous Monitoring?
The ongoing awareness of information security, vulnerabilities, and threats to support organisational risk management decisions. Required by NIST SP 800-137 and recommended by most security frameworks.
Terms that appear alongside continuous monitoring
Each of these is named in at least one of the same controls as continuous monitoring. The number is how many controls name both.
- nist 26 shared controls
- cybersecurity 16 shared controls
- audit 15 shared controls
- compliance 13 shared controls
- risk assessment 10 shared controls
- vulnerability 10 shared controls
- information security 9 shared controls
- fedramp 9 shared controls
Frameworks that govern continuous monitoring
What the standards actually require on continuous monitoring
Requirements naming continuous monitoring across 6 standards, quoted from the control text.
Continuous Monitoring + Lifecycle Management is essential to ongoing trustworthy AI per Japan AI Guidelines for Business + integrates Safety + Accountability + Transparency Principles + addresses post-deployment risks.
JP-AIG-Continuous-Monitoring-Lifecycle-Model-Evaluation-Performance-Drift-Post-Deployment · Japan AI Guidelines Continuous Monitoring + AI System Lifecycle Management + Model Evaluation + Performance Drift + Concept Drift + Post-Deployment + Retraining Triggers + Safe Update + Decommissioning + Model Card Versioning →Execute the Monitor step per NIST SP 800-37 Rev 2 Chapter 3 Step 7. Maintain ongoing situational awareness of the security and privacy posture of the system to support risk management decisions.
NISTSP37-7 · RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation →Continuous Monitoring (ConMon) is the post-authorization monitoring + reporting regime. Required activities: (a) MONTHLY vulnerability scanning + reporting via FedRAMP secure reporting portal; (b) MONTHLY POA&M update;
FedRAMP-ConMon · Continuous Monitoring (ConMon) and Significant Change Requests →Requires a system-level continuous monitoring strategy aligned to the organizational one, defining the metrics monitored, the frequencies for monitoring and for assessing control effectiveness, ongoing control assessment, correlation and analysis of the result...
NIST800-CA-7 · Continuous monitoring →Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs.
PM-31 · Continuous Monitoring Strategy →Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs.
PM-31 · Continuous Monitoring Strategy →Questions people ask about continuous monitoring
What is Continuous Monitoring?
Why is Continuous Monitoring important for compliance?
Which compliance frameworks address Continuous Monitoring?
Where can I learn more about Continuous Monitoring?
See how Continuous Monitoring applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.