CAP Information Security Continuous Monitoring (ISCM) Strategy & Implementation

Question 1

Which NIST publication specifically provides guidance for developing an Information Security Continuous Monitoring (ISCM) program?

Accepted Answer

NIST SP 800-137

Answer

NIST SP 800-137 ('Information Security Continuous Monitoring for Federal Information Systems and Organizations') provides guidance for developing an ISCM strategy, defining metrics, establishing monitoring frequencies, and reporting security status to organizational officials.

Question 2

NIST SP 800-137 defines three tiers for ISCM. Which set correctly identifies these tiers?

Accepted Answer

Organization, Mission/Business Process, Information System

Answer

NIST SP 800-137 aligns ISCM to the three-tiered risk management hierarchy from NIST SP 800-39: Tier 1 (Organization), Tier 2 (Mission/Business Process), and Tier 3 (Information System). Each tier has distinct ISCM roles and responsibilities.

Question 3

In the context of ISCM, what does 'ongoing authorization' mean?

Accepted Answer

Security status is monitored continuously, allowing the AO to make risk acceptance decisions in near real-time rather than at fixed three-year intervals.

Answer

Ongoing authorization replaces the traditional fixed three-year reauthorization cycle. By continuously monitoring security controls and reporting status, the AO maintains current situational awareness and can make risk decisions based on near real-time security posture rather than a point-in-time assessment.

Question 4

Which of the following is the FIRST step in the NIST SP 800-137 ISCM process?

Accepted Answer

Define an ISCM strategy.

Answer

The NIST SP 800-137 ISCM process follows six steps: (1) Define, (2) Establish, (3) Implement, (4) Analyze/Report, (5) Respond, (6) Review/Update. Defining the ISCM strategy — including scope, metrics, and frequencies — is the mandatory first step.

Question 5

What is the role of 'security metrics' in an ISCM program?

Accepted Answer

Metrics provide quantifiable measures of security control effectiveness and organizational security posture over time.

Answer

In ISCM, security metrics are quantifiable measures used to assess the effectiveness of security controls and track the organization's security posture over time. They enable data-driven risk decisions by the AO and support the ongoing authorization model.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Information Security Continuous Monitoring (ISCM) Strategy & Implementation