Study Fills Needs for Applied Best Practices Guidance
The Center for Regulatory Effectiveness (CRE), a regulatory watchdog, is releasing a best practices assessment of agency compliance with FISMA’s continuous monitoring requirements.
Studies have found only limited, insufficient agency adherence with FISMA’s continuous monitoring mandates. One survey found almost half of federal IT professionals were unaware of continuous monitoring requirements. A recent GAO report found that two-thirds of agencies “did not adequately monitor networks” to protect them “from intentional or unintentional harm.”
The CRE study fills the information gap by providing senior and staff level cybersecurity professionals with practical guidance in effectively implementing Information Security Continuous Monitoring (ISCM).
Based on NIST FISMA guidance and technical reference documents, CRE developed a set of five continuous monitoring principles. The study documents and explains how a federal agency thwarted an Advance Persistent Threat by adhering to the principles. The study also explains the crucial role of OMB and agency IT leadership in successfully driving agency adoption of continuous monitoring.
The study is appropriate reading for federal and private sector cyberdefense professionals who have FISMA-related responsibilities.
CRE’s FISMA Continuous Monitoring Best Practices study is attached below.
Leave a Reply