Continuous Monitoring
Monitoring keeps the authorization alive
Continuous monitoring is the ongoing cycle that determines whether controls remain effective after authorization: what to monitor, how often, by whom, and how results reach decision makers. Under NIST SP 800-137 and the final RMF step, an organization builds an information security continuous monitoring program with metrics, sensors, analytics, and reporting. Monitoring covers far more than vulnerability scanning: configuration and patch status, account and access reviews, log review, incident trends, training completion, POA&M progress, and privacy control performance. Frequency should be risk-driven - higher-impact systems and volatile controls are monitored more often. Significant changes go through a security impact analysis, and results feed an ongoing authorization decision so the AO can confirm, modify, or withdraw the authorization.
Traps
The most common error is equating continuous monitoring with quarterly scans. Another is assuming monitoring replaces assessment: monitoring generates data, but the effectiveness judgment still uses assessment methods. A third is forgetting the reporting loop - monitoring data that never reaches the AO cannot support an ongoing authorization. Watch also for change blindness: a cloud migration or new interconnection is a trigger, not routine maintenance.
Rule of thumb
Monitor what matters most, most often. Rank controls by impact and volatility, set a defensible frequency, and make sure every metric has an owner and a path to the AO.
Worked example
A moderate system scans monthly but never reviews privileged accounts. Asked what to improve, the answer is to add periodic access reviews and report them - not to increase scan frequency.