Continuous Monitoring
Ongoing awareness
Continuous monitoring maintains ongoing awareness of the security posture, vulnerabilities, and threats so that risk decisions stay current. Candidates should know its components: configuration management, control monitoring, security impact analysis of changes, and ongoing assessment of selected controls. Monitoring produces data that feeds the AO's risk decisions and can trigger reauthorization.
Strategy and metrics
A monitoring strategy defines what is monitored, how often, by whom, and what thresholds trigger action. Metrics should be meaningful and tied to risk, not merely counts of scans. Automation helps, but human review of results is essential. Monitoring also covers changes: a significant change requires security impact analysis before it is deployed.
Traps to watch
A common trap is equating continuous monitoring with running vulnerability scans. Monitoring includes control assessments, log review, configuration checks, and change analysis. Another trap is collecting data without acting on it; monitoring must close the loop with remediation and reporting. Watch also for the assumption that monitoring ends at the next authorization; it continues throughout operation.
Rule of thumb
Monitor what matters, act on what you find, and report what you decide. Worked example: monthly scans reveal a recurring misconfiguration on a public server. Rather than only patching, the team updates the baseline, adds a configuration check, and reports the trend to the AO, who confirms the risk remains acceptable.