What it means
Monitoring can be automated or manual and should cover selected controls, system changes, vulnerabilities, threats, exceptions, and indicators that matter to authorization and risk decisions.
Why it matters
Timely monitoring reduces the gap between a control failure and organizational awareness, supporting ongoing authorization and faster remediation.
Practical focus
- Prioritize controls and assets by risk
- Define metrics, frequency, thresholds, and owners
- Validate automated evidence and data quality
- Connect alerts to corrective action and risk decisions
Common mistakes
- Monitoring everything at the same frequency
- Collecting data no one reviews
- Assuming automation eliminates assessment
- Failing to update the strategy after major change
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: