---

id: "PM-31" title: "Continuous Monitoring Strategy" family: "PM" family_name: "Program Management" sort_id: "pm-31" priority: "P1" implementation_level: "organization"

---

Statement

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:

Establishing the following organization-wide metrics to be monitored: {{ insert: param, pm-31_odp.01 }};

Establishing {{ insert: param, pm-31_odp.02 }} and {{ insert: param, pm-31_odp.03 }} for control effectiveness;

Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;

Correlation and analysis of information generated by control assessments and monitoring;

Response actions to address results of the analysis of control assessment and monitoring information; and

Reporting the security and privacy status of organizational systems to {{ insert: param, pm-31_prm_4 }} {{ insert: param, pm-31_prm_5 }}.

Guidance

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, AC-2g, AC-2(7), AC-2(12)(a), AC-2(7)(b), AC-2(7)(c), AC-17(1), AT-4a, AU-13, AU-13(1), AU-13(2), CA-7, CM-3f, CM-6d, CM-11c, IR-5, MA-2b, MA-3a, MA-4a, PE-3d, PE-6, PE-14b, PE-16, PE-20, PM-6, PM-23, PS-7e, SA-9c, SC-5(3)(b), SC-7a, SC-7(24)(b), SC-18b, SC-43b, SI-4.

Assessment Objective

an organization-wide continuous monitoring strategy is developed;

Assessment Objective: continuous monitoring programs are implemented that include establishing {{ insert: param, pm-31_odp.01 }} to be monitored;

Assessment Objective: continuous monitoring programs are implemented that establish {{ insert: param, pm-31_odp.02 }} for monitoring;

Assessment Objective: continuous monitoring programs are implemented that establish {{ insert: param, pm-31_odp.03 }} for assessment of control effectiveness;

Assessment Objective: continuous monitoring programs are implemented that include monitoring {{ insert: param, pm-31_odp.01 }} on an ongoing basis in accordance with the continuous monitoring strategy;

Assessment Objective: continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;

Assessment Objective: continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;

Assessment Objective: continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;

Assessment Objective: continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;

Assessment Objective: continuous monitoring programs are implemented that include reporting the security status of organizational systems to {{ insert: param, pm-31_odp.04 }} {{ insert: param, pm-31_odp.06 }};

Assessment Objective: continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to {{ insert: param, pm-31_odp.05 }} {{ insert: param, pm-31_odp.07 }}.

Information security program plan

privacy program plan

supply chain risk management plan

continuous monitoring strategy

risk management strategy

information security continuous monitoring program documentation, reporting, metrics, and artifacts

information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts

assessment and authorization policy

procedures addressing the continuous monitoring of controls

privacy program continuous monitoring documentation, reporting, metrics, and artifacts

continuous monitoring program records, security, and privacy impact analyses

status reports

risk response documentation

other relevant documents or records.

Senior Accountable Official for Risk Management

chief information officer

senior agency information security officer

senior agency official for privacy

organizational personnel with information security, privacy, and supply chain risk management program responsibilities

Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring