NIST SP 800-137

Dr. Ron Ross, a Fellow at NIST and leader of the FISMA Implementation Project, emphasized the importance of continuous monitoring in discussing the forthcoming NIST SP 800-53, Rev. 4 set of security controls.  Dr. Ross stated that Rev. 4 supports “A New Cyber Defense Vision — Build it right — Continuously Monitor.”  The presentation was provided at a meeting of the Internet Security and Privacy Advisory Board (ISPAB) held on the NIST campus in Gaithersburg, MD.

The presentation described four key aspects of the future of cyber defense:

1. Develop risk-aware mission business processes;
2. Develop and implement enterprise architectures with embedded information security architectures;
3. Use information technology wisely considering the current threat landscape (capabilities, intent, targeting); and
4. Develop and implement robust continuous monitoring programs.

Dr. Ross identified three primary purposes of continuous monitoring:

1. Determine effectiveness of risk mitigation measures;
2. Identify changes to information systems and environments of operation; and
3. Verify compliance.

The bottom line emphasized by Dr. Ross is that continuous monitoring should “increase situational awareness to help determine risk to organizational operations and assets, individuals, other organizations, and the Nation.”

NIST expects to release a final public draft of SP SP 800-53, Rev 4 in July 2012 for a short comment period of about two weeks with the final document intended for publication in September 2012.

For more information about the presentation, please see Update on NIST SP 800-53 Rev. 4 on FISMA Focus.