Compliance Maintenance
Compliance maintenance tests whether you can keep an authorization valid: monitoring controls continuously, managing change, closing POA&Ms, and reauthorizing when the risk posture shifts.
Continuous monitoring
NIST SP 800-137 defines an information security continuous monitoring (ISCM) program with six steps: define the strategy, establish the program, implement it, analyze and report findings, respond, and review and update. The strategy ties monitoring to the controls that matter most, sets frequencies from risk rather than habit, and defines metrics and thresholds so anomalies produce action. Ongoing authorization replaces the idea that a system is finished once authorized.
Change and reauthorization
Under SP 800-37 Rev. 2, a significant change - a new interconnection, changed categorization, new technology, removal of controls, or a shift in the threat environment - triggers analysis by the system owner and an AO decision on whether reauthorization or additional assessment is needed. Routine changes flow through configuration management.
Worked example
Six months into an ATO, the team migrates logging from an on-premises SIEM to a cloud service and closes a data center. The ISSO documents both changes, the system owner judges them significant because data location and control ownership changed, and the AO requires a targeted assessment of AU controls and an updated SSP before the change is accepted. Old SIEM POA&M items are closed with evidence, and new milestones cover the new provider.
Other maintenance duties
- Track POA&M status against milestones and escalate slippage.
- Feed monitoring results into annual reporting and agency FISMA metrics.
- Reassess privacy controls when data use changes; update PIAs and SORNs.
- Decommission properly: sanitize media, revoke accounts, remove the system from inventory.
Traps that cost marks
- Monitoring everything at one frequency, or monitoring only what is easy to measure.
- Treating all changes as routine so the SSP and assessment fall behind reality.
- Closing POA&M items without evidence of remediation.
- Letting an authorization lapse without a new decision.