03.12.03 — Continuous Monitoring

Official NIST requirement content

Security requirement

Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.

Official NIST discussion

Discussion

Continuous monitoring at the system level facilitates ongoing awareness of the system security posture to support risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk-based decisions. Different types of security requirements may require different monitoring frequencies.

Bare Metal Cyber interpretation

Implementation perspective

Treat Continuous Monitoring as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to assessment planning, evidence quality, remediation, continuous monitoring, and system security plan accuracy.

Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
Resolve every organization-defined parameter through an approved governance and tailoring process.
Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.

Questions to ask

Which CUI assets, data flows, users, and services are protected by this requirement?
Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
What change, incident, or threshold should trigger reassessment?

Evidence and validation

assessment plans and reports
plans of action and milestones
system security plans
continuous monitoring results

Common failure patterns

requirement status based only on owner assertion
findings closed without evidence
scope missing inherited services
monitoring data disconnected from risk decisions

Official NIST SP 800-171A content

Assessment objectives and methods

Assessment objectives (4)

SR-03.12.3.
a system-level continuous monitoring strategy is developed.
SR-03.12.3.
a system-level continuous monitoring strategy is implemented.
SR-03.12.3.
ongoing monitoring is included in the continuous monitoring strategy.
SR-03.12.3.
security assessments are included in the continuous monitoring strategy.

Examine

security assessment and monitoring policy and procedures
organizational continuous monitoring strategy
system-level continuous monitoring strategy
procedures for continuous monitoring of the system
procedures for configuration management
security assessment report
plan of action and milestones
system monitoring records
configuration management records
impact analyses
status reports
system security plan
other relevant documents or records

Interview

personnel with continuous monitoring responsibilities
personnel with information security responsibilities
system administrators

Test

mechanisms for implementing continuous monitoring
mechanisms for supporting response actions for assessment and monitoring results
mechanisms for supporting security status reporting

Official source-control relationships

Source NIST SP 800-53 controls

These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.

Source controlCA-7Open SP 800-53 control →

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.