Continuous Monitoring Strategy Flashcards

What is the primary goal of continuous monitoring in the context of the RMF?

Answer: To maintain ongoing situational awareness of the security state of information systems and detect changes that affect risk

Continuous monitoring provides real-time or near real-time visibility into the security posture of systems so that risk can be managed dynamically.

Which NIST publication provides the primary guidance for information security continuous monitoring (ISCM)?

Answer: NIST SP 800-137

NIST SP 800-137 provides guidance for developing a continuous monitoring strategy and program for federal information systems.

What are the six steps of the ISCM process defined in NIST SP 800-137?

Answer: Define, Establish, Implement, Analyze/Report, Respond, Review/Update

NIST SP 800-137 defines the ISCM process as: Define strategy, Establish program, Implement program, Analyze/Report findings, Respond to findings, and Review/Update the program.

What is a Security Information and Event Management (SIEM) system's primary role in continuous monitoring?

Answer: To aggregate, correlate, and analyze security event logs from across the enterprise in near real-time

A SIEM collects logs from multiple sources, correlates events, and generates alerts to enable rapid detection of security incidents.

What is the purpose of defining monitoring frequencies in a continuous monitoring strategy?

Answer: To establish how often each control is assessed based on its volatility, importance, and available resources

Monitoring frequencies are tailored to each control based on how often it changes, its criticality, and the resources available to monitor it.

How does continuous monitoring support the 'Monitor' step of the RMF?

Answer: By providing ongoing assessment of controls, documenting changes, and reporting security status to the AO

The Monitor step of the RMF is implemented through a continuous monitoring program that tracks control effectiveness and reports status to decision-makers.