Continuous Monitoring (DE.CM) — NIST CSF 2.0 Category

CategoryDE.CM — Continuous Monitoring

FunctionDE — Detect CategoryDE.CM — Continuous Monitoring

Official CSF Core outcome
Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events.

Category outcome

NIST CSF 2.0 places Continuous Monitoring (DE.CM) within the Detect Function. The official Category outcome is: “Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events.”

This Category provides a structured way to address monitoring networks, facilities, personnel activity, external services, platforms, and runtime environments. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Continuous Monitoring capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

Define monitoring coverage for networks, endpoints, identities, applications, cloud, physical spaces, and suppliers.
Collect protected telemetry with sufficient context, time quality, and retention.
Monitor sensor and data-pipeline health as well as security events.
Tune collection and detections based on threats, architecture, and operating changes.
Measure blind spots and assign owners for coverage gaps.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

Monitoring architecture and coverage maps
Sensor, agent, and telemetry-source inventories
Data quality, time synchronization, retention, and health measures
Alert, anomaly, and indicator records
Coverage-gap, tuning, and corrective-action records

Subcategories within DE.CM

This Category contains 5 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

DE.CM-01 — Monitor Networks and Network Services: Networks and network services are monitored to find potentially adverse events
DE.CM-02 — Monitor the Physical Environment: The physical environment is monitored to find potentially adverse events
DE.CM-03 — Monitor Personnel Activity and Technology Use: Personnel activity and technology usage are monitored to find potentially adverse events
DE.CM-06 — Monitor External Service Providers: External service provider activities and services are monitored to find potentially adverse events
DE.CM-09 — Monitor Computing and Runtime Environments: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

High-volume telemetry is mistaken for complete visibility.
Monitoring gaps are known but not owned or prioritized.
External services and runtime environments are omitted.
Detection content is not updated when systems and threats change.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Search Bare Metal Cyber