«

»

Oct
03

NIST Emphasizes Role of Automation, Metrics in Continuous Monitoring

NIST has finalized Special Publication (SP) 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, the document is attached below. 
 
The newly finalized guidance document explains that the federal requirement for the monitoring of information systems originated in OMB’s Circular A-130 originally published in 1997.  The Circular requires agencies to “Review Security Controls.”  Specifically, the Circular directs agencies to “Review the security controls in each system when significant modifications are made to the system, but at least every three years. The scope and frequency of the review should be commensurate with the acceptable level of risk for the system.”  Thus, SP 800-137 builds on long-standing federal policy requirements for IT security. 
 
SP 800-137 provides a very broad, conceptual definition of continuous monitoring: 
Information security continuous monitoring (ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. 

The finalized document recognizes the essential role of automated systems in ensuring the monitoring of federal information systems.  NIST explains that:

Tools supporting automated monitoring of some aspects of information systems have become an effective means for both data capture and data analysis. Ease of use, accessibility, and broad applicability across products and across vendors help to ensure that monitoring tools can be readily deployed in support of near real-time, risk-based decision making.

The document emphasizes that organizations need metrics for the data that is monitored.  Metrics and monitoring work together to improve an organization’s security awareness.  As NIST explains:

Through the use of automation, it is possible to monitor a greater number of security metrics with fewer resources, higher frequencies, larger sample sizes, and with greater consistency and reliability than is feasible using manual processes. Organizations regularly review the ISCM strategy to ensure that metrics continue to be relevant, meaningful, actionable, and supportive of risk management decisions made by organizational officials at all tiers.

SP 800-137 is attached below.  CRE’s comments on the draft document may be found here.

Leave a Reply

Please Answer: *