Continuous Monitoring Flashcards

An organization's CGRC-aligned continuous monitoring strategy defines monitoring frequency per control. A control's volatility has increased after a major architecture change, but the system's overall impact level has not changed. According to NIST SP 800-137, which factor should PRIMARILY drive the decision to increase that control's assessment frequency?

Answer: The control's volatility together with the system's current risk posture and threat information

NIST SP 800-137 states that monitoring frequency should be set based on control volatility, system categorization/impact, controls providing critical functions, controls with identified weaknesses, organizational risk tolerance, and threat/vulnerability information. Since the impact level is unchanged but volatility and architecture have changed, volatility plus current risk posture and threat information drive the adjustment. The ATO date and POA&M count are not primary drivers of frequency.

During ongoing authorization under RMF, the authorizing official (AO) has delegated authority to review monitoring results. A scheduled automated scan reveals a newly discovered vulnerability in a common control inherited from an enterprise provider. The vulnerability is rated high, and the provider says it will be remediated in 120 days. What is the MOST appropriate action for the system owner?

Answer: Assess the impact on the system's risk, communicate with the common control provider, and report to the AO with a POA&M entry or compensating measures as needed

Inherited controls still affect the inheriting system's risk. The system owner must assess how the weakness changes the system's risk, coordinate with the provider, and provide the information to the AO so a risk-based decision can be made, typically with a POA&M and any compensating measures. Responsibility is not eliminated by inheritance, and revoking the ATO or unilaterally reclassifying the control are not the standard responses.

A system uses an automated tool to feed security status metrics into a dashboard for the AO. An assessor finds that the tool reports a control as 'satisfied' based solely on the presence of a configuration file, without verifying that the setting is actually enforced on running hosts. Which continuous monitoring concern does this MOST directly illustrate?

Answer: Weak metric validity, where the measurement does not accurately reflect the control's real effectiveness

Effective metrics must measure what they claim to. Reporting a control as satisfied because a file exists, rather than verifying actual enforcement, gives a false sense of assurance. This is a metric validity (and potentially assessment depth) issue, not a frequency, manual-effort, or reporting-structure problem.

Under the NIST RMF Monitor step, a system's operating environment changes when a new third-party SaaS integration begins processing data from the system. The system's security plan was not updated. Which monitoring activity is MOST directly failing?

Answer: Monitoring of changes to the system and environment, including security impact analyses

The RMF Monitor step requires ongoing monitoring of changes to the system and its environment of operation, including performing security impact analyses of changes and updating the security plan and related documents. A new integration that is not analyzed or documented indicates a failure of change monitoring and security impact analysis, rather than control assessment or POA&M tracking.

An organization wants its continuous monitoring program to support a risk-based, ongoing authorization decision rather than a three-year reauthorization cycle. Which condition is MOST essential for the AO to accept ongoing authorization?

Answer: A mature continuous monitoring program provides timely, sufficient risk information to the AO, who has defined the trigger conditions that would require a reauthorization review

Ongoing authorization depends on the AO having sufficient, timely, and trustworthy information from a mature continuous monitoring program, and on having established criteria or triggers (such as significant changes or risk thresholds) that would prompt a formal review or reauthorization. Impact level alone, full annual assessment, or zero POA&M items are neither required nor realistic conditions.

A continuous monitoring program tracks a metric showing 'percentage of systems patched within 30 days.' Over several quarters, the metric holds steady at 97%, yet an incident occurs through an unpatched, internet-facing system in the remaining 3%. What is the best interpretation for improving the monitoring program?

Answer: The aggregate metric masks risk concentration; supplement it with risk-weighted measures that account for asset criticality and exposure

Aggregate compliance percentages can hide the highest-risk exceptions. Mature programs complement them with risk-based measures that consider asset criticality, exposure, and exploitability so that high-impact outliers receive attention. The metric is still useful, but insufficient on its own; reducing frequency or dismissing the incident would worsen risk visibility.