Continuous Monitoring
What is Continuous Monitoring?
The ongoing awareness of information security, vulnerabilities, and threats to support organisational risk management decisions. Required by NIST SP 800-137 and recommended by most security frameworks.
Terms that appear alongside continuous monitoring
Each of these is named in at least one of the same controls as continuous monitoring. The number is how many controls name both.
- nist 26 shared controls
- cybersecurity 16 shared controls
- audit 15 shared controls
- compliance 13 shared controls
- risk assessment 10 shared controls
- vulnerability 10 shared controls
- information security 9 shared controls
- fedramp 9 shared controls
Frameworks that govern continuous monitoring
What the standards actually require on continuous monitoring
Requirements naming continuous monitoring across 6 standards, quoted from the control text.
Continuous monitoring follows NIST SP 800-137 to give operational visibility, managed change control and attendance to incident response, and a mature ConMon capability, evaluated during the assessment and the reviews, is a condition of authorization.
fedramp-rev-5::C.1 · C.1 Monthly continuous monitoring deliverables →Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
NIST800-CA-7(1) · CA-7(1) Continuous Monitoring | Independent Assessment →Employ independent assessors or teams to monitor the system's controls on an ongoing basis.
fbi-cjis-security-policy::CA-7(1) · CA-7(1) Continuous Monitoring | Independent Assessment →Execute the Monitor step per NIST SP 800-37 Rev 2 Chapter 3 Step 7. Maintain ongoing situational awareness of the security and privacy posture of the system to support risk management decisions.
NISTSP37-7 · RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation →Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
nist-sp-800-53-revision-5-1-high::CA-7(1) · CA-7(1) Continuous Monitoring | Independent Assessment →Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
nist-sp-800-53-rev-5-moderate::CA-7(1) · CA-7(1) Continuous Monitoring | Independent Assessment →Questions people ask about continuous monitoring
What is Continuous Monitoring?
Why is Continuous Monitoring important for compliance?
Which compliance frameworks address Continuous Monitoring?
Where can I learn more about Continuous Monitoring?
See how Continuous Monitoring applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.