Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment

Dempsey, Kelley; Pillitteri, Victoria; Baer, Chad; Niemeyer, Robert; Rudman, Ron; Urban, Susan

doi:https://doi.org/10.6028/NIST.SP.800-137A

SP 800-137A

Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment

Documentation Topics

Date Published: May 2020

Planning Note (3/31/2021):

NISTIR 8212, An Information Security Continuous Monitoring Program Assessment, provides an operational approach to the assessment of an organization’s ISCM program using ISCMAx – a free, publicly available working implementation of the ISCM program assessment described in NIST SP 800-137A.

Author(s)

Kelley Dempsey (NIST), Victoria Pillitteri (NIST), Chad Baer (CISA), Robert Niemeyer (MITRE), Ron Rudman (MITRE), Susan Urban (MITRE)

Abstract

This publication describes an approach for the development of Information Security Continuous Monitoring (ISCM) program assessments that can be used to evaluate ISCM programs within federal, state, and local governmental organizations and commercial enterprises. An ISCM program assessment provides organizational leadership with information on the effectiveness and completeness of the organization’s ISCM program, including the review of ISCM strategies, policies, procedures, operations, and analysis of continuous monitoring data. The ISCM assessment approach can be used as presented or as the starting point for an organization-specific methodology. It includes example evaluation criteria and assessment procedures that can be applied to organizations.

Keywords

assessment; assessment element; assessment methodology; assessment procedure; continuous monitoring; information security continuous monitoring; ISCM program; ISCM program assessment

Control Families

None selected

Documentation

Publication:
SP 800-137A (DOI)
Local Download

Supplemental Material:
Element Catalog for SP 800-137A (xls)

Other Parts of this Publication:
SP 800-137

Related NIST Publications:
NISTIR 8212

Document History:
01/13/20: SP 800-137A (Draft)
05/21/20: SP 800-137A (Final)

Topics

Security and Privacy
continuous monitoring; risk assessment; system authorization

Laws and Regulations
Federal Information Security Modernization Act