Continuous Monitoring Flashcards

An agency's authorization to operate (ATO) was granted under a traditional three-year reauthorization cycle. The CISO now wants to move to ongoing authorization. Which condition MUST be satisfied before the authorizing official can rely on continuous monitoring in place of periodic full reassessments?

Answer: An organization-approved ISCM strategy exists at the organization, mission/business, and system tiers, and the AO has agreed to the monitoring frequencies and the metrics that provide near real-time risk visibility

Under NIST SP 800-137 and the RMF Monitor step, ongoing authorization depends on a mature ISCM program: an approved strategy spanning the three tiers, with the AO agreeing to monitoring frequencies and risk metrics so they have sufficient, current information to make risk-based decisions. Having no POA&M items is not required, automation need not cover every control (some controls require manual or procedural assessment), and a recent full reassessment is not a prerequisite.

During monitoring, a system's vulnerability scanner reports a critical finding on a component that supports a control previously assessed as 'Satisfied.' The vendor patch will take 60 days to release, and a compensating measure (network segmentation) is deployed immediately. What is the MOST appropriate next action for the security control assessor and system owner?

Answer: Reassess the affected control(s) with the compensating measure in scope, update the SAR and POA&M with milestones, and report the residual risk to the AO for a risk-based decision

A significant finding during monitoring requires the affected control to be reassessed, including verifying that the compensating control is effective, with documentation updated (assessment results, POA&M with milestone dates) and residual risk communicated to the AO, who decides whether to continue operating. Automatically revoking the ATO is not the required response, assuming the compensating measure suffices without validation skips assessment, and unilaterally changing the boundary bypasses AO oversight.

An organization is defining monitoring frequency for a set of controls. Which factor should NOT be the primary driver when determining that frequency under NIST SP 800-137 guidance?

Answer: The preferred reporting schedule of the vendor whose tool performs the check

SP 800-137 states that frequencies should be driven by control volatility, system categorization/impact, control criticality, threat and vulnerability information, risk assessment results, and reporting requirements of the organization. A vendor tool's default reporting cadence is an implementation detail and should not determine how often an organization needs assurance about a control.

A cloud-hosted system inherits several controls from a FedRAMP-authorized IaaS provider. During the Monitor step, the provider issues a significant change notice affecting its hypervisor isolation boundary. What should the customer's CGRC practitioner do?

Answer: Evaluate the impact on inherited controls and the customer's system risk, obtain updated provider assessment evidence, and adjust the customer's documentation, POA&M, and AO reporting as needed

Inherited controls remain part of the customer's risk picture. The customer must analyze the provider's change, gather current assessment evidence, and update its security documentation and risk posture, then report to the AO if the risk changes. Ignoring the change, terminating the contract by reflex, or deferring review to the annual cycle fails the ongoing duty to maintain situational awareness.

Which scenario BEST illustrates a change that should trigger a formal security impact analysis (SIA) rather than being handled as routine within the continuous monitoring process?

Answer: Adding a new third-party API integration that transmits categorized data outside the existing authorization boundary

A new external integration that moves categorized data across the authorization boundary can alter the attack surface, data flows, interconnection agreements, and control effectiveness, so it requires a security impact analysis and possible reassessment. Routine patching, credential rotation, and editorial procedure updates are normal operations covered by existing processes and do not change the boundary or risk profile.

An ISCM program collects metrics from many sources, but the AO complains that the dashboards don't help with decisions. According to ISCM principles, what is the BEST corrective approach?

Answer: Derive metrics from the organization's risk tolerance and security objectives, ensuring each is actionable, tied to a control or risk, and aggregated appropriately for the intended tier audience

Effective ISCM metrics trace to organizational risk tolerance and objectives, are meaningful and actionable, and are aggregated and presented to suit the audience at each tier. More data alone creates noise, a single percentage hides risk, and annual-only reporting defeats the purpose of ongoing situational awareness.