NIST SP 800-137: continuous monitoring

What category of publication this is

NIST Special Publication 800-137 is the subject. The official title is Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. The CSRC abstract states its purpose. The purpose is to help organizations develop a continuous monitoring strategy and implement a continuous monitoring program. That program is meant to provide visibility into organizational assets and awareness of threats and vulnerabilities. It is also meant to provide visibility into the effectiveness of deployed security controls. It supports assurance over time that planned and implemented controls stay aligned with organizational risk tolerance. It also supplies the information that is needed to respond when observations suggest that the controls are inadequate.

A common misread treats a monitor dashboard as Authorization. Another misread treats continuous monitoring as a slogan. SP 800-137 is a NIST publication, not a statute or a scoring product.

Continuous monitoring, the seven RMF steps, a FedRAMP package, a SIEM purchase, and an SP 800-30 assessment are five different objects.

One definition, and what continuous means

The executive summary and Chapter 1 define information security continuous monitoring (ISCM). The definition is "maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions."

A footnote in Chapter 1 defines the words "continuous" and "ongoing" in this context. They mean that security controls and organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security decisions. Data collection, no matter how frequent, is performed at discrete intervals. The publication does not set collection intervals, metrics, or service levels.

Where this publication sits

SP 800-137 (2011) describes ISCM as part of the Risk Management Framework. It states that information collected through the program supports ongoing authorization decisions. The seven-step order comes from SP 800-37 Rev. 2 (NIST SP 800-37: the Risk Management Framework). The steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. ISCM supports the Monitor theme. It can inform an ongoing authorization decision. Monitors that run do not mean that those seven steps are finished.

SP 800-30 Rev. 1 (NIST SP 800-30: assessing risk) is guidance to conduct risk assessments. The steps there are prepare, conduct, communicate, and maintain. The risk vocabulary is related to ISCM, but the object is different.

SP 800-53 (NIST SP 800-53: choosing security and privacy controls and NIST SP 800-53) is a control catalog. SP 800-137 states that many technical controls are candidates to monitor with automation. It also states that management and operational controls still need assessment when a tool cannot watch them. A catalog is not an ISCM program.

FedRAMP (FedRAMP: federal cloud authorization) is a cloud Authorization reuse lane for products and services that federal agencies use. Related vocabulary for continuous monitoring can show up beside that lane. A FedRAMP package is not this publication finished. FISMA (FISMA: federal information security) is the statutory backdrop for federal agency information security management. The SP 800-137 authority section cites that backdrop. FISMA is context, not this publication.

SP 800-137A is the assessment companion for ISCM programs. Its official title is Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment. Date Published May 2020. Document history stamps Final on 2020-05-21 (shown there as 05/21/20). DOI 10.6028/NIST.SP.800-137A. The official page is https://csrc.nist.gov/pubs/sp/800/137/a/final.

A Planning Note on that CSRC page, dated 2021-03-31, points at NISTIR 8212.

SP 800-39 is the organization-wide information security risk management publication. SP 800-30 already cites it. The official page is https://csrc.nist.gov/pubs/sp/800/39/final.

Six steps

Chapter 3 and the CSRC glossary entry for the ISCM process list six steps. The first steps are define an ISCM strategy, establish an ISCM program, and implement an ISCM program. The next steps are analyze data and report findings, respond to findings, and review and update the ISCM strategy and program.

Define is a risk-tolerance-aware strategy. That strategy covers visibility into assets, awareness of threats and vulnerabilities, and visibility into control effectiveness. Establish covers metrics, how often status is monitored, how often controls are assessed, and technical architecture themes. Implement collects the security-related information. It automates where that helps, without a claim that every control is automatable. Analyze and report turns collection into decision-useful status. More data can be necessary before action. Respond mitigates, accepts, transfers or shares, or avoids or rejects, in line with risk tolerance. Review and update revisits the strategy and program when missions, systems, threats, or metrics no longer fit.

The executive summary states that security architectures, operational capabilities, and monitor processes improve and mature over time. It also states that the strategy and program are routinely reviewed. A dashboard without analysis and response does not complete the ISCM process. The Appendix D catalogs, Technologies for Enabling ISCM, stay in the PDF.

Rewrite the one-line claim

The claim "we are RMF, continuous monitoring, FedRAMP, SIEM, and NIST compliant" mixes five objects. Exact replacement: "We use SP 800-137 literacy for ISCM strategy and program themes (define, establish, implement, analyze and report, respond, review and update)." That literacy can inform the seven RMF steps, an SP 800-30 assessment, or a FedRAMP lane. It is different from each of them and from a single monitor product.

The team picks one system that it touches. The team privately decides whether the live question is strategy, collection, analysis, response, or review and update. The team also decides which process applies, such as an agency RMF or FedRAMP.

Continuous monitoring is not RMF finished, not FedRAMP, not a SIEM, and not an always authorized badge

Define, establish, implement, analyze and report, respond, review and update

The steps come from SP 800-137, Chapter 3, and the CSRC glossary entry for the ISCM process.

Glossary and nearby pages

• Risk
• Threat
• Vulnerability
• Control
• Evidence
• SIEM

• SP 800-37 explainer (RMF process, ISCM supports Monitor)
• SP 800-30 explainer (assessment process, not this program)
• SP 800-53 explainer (control catalog)
• NIST SP 800-53 Reference card (catalog summary)
• FISMA explainer (statutory backdrop only)
• FedRAMP explainer (cloud Authorization, different object)
• GRC practice path
• Public sector industry path
• SP 800-137A on NIST CSRC (name only, no Atlas page)
• SP 800-39 on NIST CSRC (name only, no Atlas page)
• Privacy is not a CIA checkbox