ISCMA: An Information Security Continuous Monitoring Program Assessment

Dempsey, Kelley; Pillitteri, Victoria; Baer, Chad; Rudman, Ron; Niemeyer, Robert; Urban, Susan

doi:https://doi.org/10.6028/NIST.IR.8212

NISTIR 8212

ISCMA: An Information Security Continuous Monitoring Program Assessment

Documentation Topics

Date Published: March 2021

Planning Note (3/31/2021):

The ISCMAx tool available under Supplemental Material is a macro-enabled Microsoft Excel application that runs on Windows-based systems only. ISCMAx is not intended to be a production-level product.

Author(s)

Kelley Dempsey (NIST), Victoria Pillitteri (NIST), Chad Baer (DHS), Ron Rudman (MITRE), Robert Niemeyer (MITRE), Susan Urban (MITRE)

Abstract

This publication describes an example methodology for assessing an organization’s Information Security Continuous Monitoring (ISCM) program. It was developed directly from NIST guidance and is applicable to any organization, public or private. It can be used as documented or as the starting point for a different methodology. Included with the methodology is a reference implementation that is directly usable for conducting an ISCM assessment.

Keywords

assessment; continuous monitoring; information security continuous monitoring; information security continuous monitoring assessment; ISCM; ISCMA; ISCMAx

Control Families

None selected

Documentation

Publication:
NISTIR 8212 (DOI)
Local Download

Supplemental Material:
ISCMAx: Recommended Judgments (xls)
ISCMAx: Alternate Judgments (xls)

Related NIST Publications:
SP 800-137A

Document History:
10/01/20: NISTIR 8212 (Draft)
03/31/21: NISTIR 8212 (Final)

Topics

Security and Privacy
continuous monitoring; program management; risk assessment

Laws and Regulations
Federal Information Security Modernization Act; OMB Circular A-130