Continuous Monitoring
Monitor as an ongoing process
The Monitor step keeps authorization valid by continuously understanding security and privacy posture. SP 800-137 describes information security continuous monitoring (ISCM): a strategy, metrics, data collection, analysis, reporting, and response. Monitoring includes ongoing control assessments, vulnerability and configuration monitoring, inventory and change management, POA&M tracking, and status reporting to the AO. Monitoring frequencies are risk-based; high-impact controls and volatile areas are checked more often.
Ongoing authorization and significant change
Ongoing authorization uses monitoring results and AO-defined risk tolerances to decide whether the authorization remains valid. A significant change-new interconnection, major architecture change, new data type, or a serious incident-triggers security impact analysis and possibly reassessment and reauthorization. Change management and configuration control are therefore part of monitoring, not separate from it.
Traps
Continuous monitoring is not just continuous scanning. Annual FISMA reporting does not replace continuous monitoring. Not every control is monitored at the same frequency, and monitoring data that never reaches the AO does not support a risk decision. Another trap is assuming an ATO eliminates the need for monitoring.
Worked example
An organization scans monthly, reviews privileged accounts quarterly, assesses a rotating subset of controls annually, and reports metrics to the AO. When a new cloud interconnection is proposed, the team performs a security impact analysis and updates the authorization package. Rule of thumb: monitor, analyze, report, and act-then feed the results back into the RMF.