Continuous Monitoring Flashcards

During a continuous monitoring review, an ISSO discovers that a system's vulnerability scanner has been running with credentialed scans disabled for two quarters because of a service-account lockout issue. The ISCM strategy defines a monthly scan frequency, and the scan results have consistently shown low findings counts. What is the MOST appropriate assessment of this situation?

Answer: The monitoring coverage is degraded; the low finding counts are unreliable, and the issue should be documented, the control assessment reconsidered, and a POA&M item opened if the deficiency is confirmed

Unauthenticated scans give limited visibility into patch levels and configuration, so low findings counts do not demonstrate a good security posture. Under NIST SP 800-137 and RMF Monitor step tasks, the organization must ensure monitoring is effective (not merely performed on schedule), report the degraded coverage to the authorizing official, and track corrective action through the POA&M. Revoking the ATO is premature, and reducing frequency would worsen visibility.

An organization is transitioning a system from periodic three-year reauthorization to ongoing authorization. Which of the following is the essential prerequisite that must be in place BEFORE the authorizing official can move the system to ongoing authorization?

Answer: An approved ISCM strategy and program in place that provides sufficient, near real-time information on the security and privacy posture, with the system having a current authorization

NIST SP 800-37 Rev. 2 states that ongoing authorization is only possible when the organization has an approved ISCM strategy and program in place, and the system has a current authorization. The AO then determines risk acceptability on a continuing basis from the monitoring data. Open POA&M items are expected and do not block ongoing authorization, and no penetration test or impact-level change is required.

A system's continuous monitoring dashboard shows that a critical control is generating an automated metric that has remained at 100% compliance for 14 months without any variance, even after two major infrastructure changes. Which conclusion is MOST defensible from a monitoring-assurance perspective?

Answer: The metric should be validated, since a metric that never varies may indicate a faulty collector, an overly narrow measurement scope, or a stale baseline

A metric with zero variance across significant change events suggests a measurement problem (broken sensor, wrong scope, stale baseline) and the organization should validate that the monitoring is actually capturing the intended data. NIST SP 800-137 emphasizes that metrics must be meaningful, and the ISCM program must be reviewed and revised for effectiveness. Reducing frequency or removing the metric without validation leaves a blind spot.

Under the RMF Monitor step, a significant change to a system is proposed: migrating its database tier from an on-premises data center to a FedRAMP-authorized IaaS. The security impact analysis shows several inherited controls will now come from the cloud provider. What is the MOST appropriate next action regarding ongoing monitoring?

Answer: Update the ISCM strategy and system documentation to reflect the changed control inheritance and customer-responsible controls, obtain and review the provider's monitoring deliverables, and have the AO review the change for reauthorization or continued authorization

Change in control inheritance affects the monitoring scope. The organization remains responsible for customer-responsible controls and for reviewing the provider's monthly ConMon deliverables, while the security plan, ISCM strategy, and assessment plan must be updated and the AO informed to determine risk acceptability. Discontinuing monitoring or restarting the full RMF is excessive, and waiting for the annual cycle is non-compliant with change management requirements.

An assessor reviews the POA&M of a system under continuous monitoring and notes a high-severity weakness whose scheduled completion date has been extended three times with no milestone progress, while the AO's risk acceptance for it expired two months ago. Which action is MOST aligned with RMF Monitor step expectations?

Answer: Escalate to the AO for a fresh risk determination based on current threat and impact information, document the revised decision, and update the POA&M with realistic milestones or a documented acceptance

An expired risk acceptance means the AO's risk decision is no longer valid; the AO must make a new, informed determination with current threat information. The POA&M must accurately reflect the decision and have credible milestones. Repeatedly extending dates or silently closing or removing items undermines the integrity of the risk reporting process.

A system owner proposes using only automated tools for all ISCM activities and eliminating manual and interview-based assessment methods entirely, arguing that automation provides greater frequency and consistency. Which statement BEST identifies the flaw in this approach?

Answer: Some controls, particularly management and operational ones such as personnel security, training effectiveness, and policy adherence, cannot be fully assessed by automated tooling and require manual or interview-based methods at defined frequencies

NIST SP 800-137 notes that not all controls can be monitored through automation; many management and operational controls require manual examination or interviews. A sound ISCM strategy blends automated and manual methods and sets frequencies based on control volatility and risk. Automation is encouraged, not prohibited, and does not fully replace human assessment.