PM-31—Continuous Monitoring Strategy

PRIVACY

>Control Description

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: ⚙organization-defined metrics; b. Establishing ⚙organization-defined monitoring frequencies and ⚙organization-defined assessment frequencies for control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to ⚙organization-defined personnel or roles ⚙organization-defined frequency.

>Cross-Framework Mappings

NIST CSF 2.0

via NIST CSF 2.0 Concept Crosswalk

SCF

MON-01

Compare

>Supplemental Guidance

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies.

The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions.

To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, AC-02g, AC-02(07), AC-02(12)(a), AC-02(07)(b), AC-02(07)(c), AC-17(01), AT-04a, AU-13, AU-13(01), AU-13(02), CA-07, CM-03f, CM-06d, CM-11c, IR-05, MA-02b, MA-03a, MA-04a, PE-03d, PE-06, PE-14b, PE-16, PE-20, PM-06, PM-23, PS-07e, SA-09c, SC-05(03)(b), SC-07a, SC-07(24)(b), SC-18b, SC-43b, SI-04.

>Related Controls

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What is the process for developing and maintaining privacy incident response capabilities?
•How does the organization integrate privacy incident response with security incident response?
•Who is responsible for overseeing privacy incident response?
•What constitutes a privacy incident, and how are they reported and escalated?
•What governance exists for learning from and improving privacy incident response?

Technical Implementation:

•What systems or tools support privacy incident response?
•How are privacy incidents detected and reported?
•What integration exists between privacy incident response and security incident response tools?
•How are privacy breach notifications generated and delivered?

Evidence & Documentation:

•Provide privacy incident response plan documentation.
•Provide privacy incident records from the past year.
•Provide evidence of privacy incident investigation and response.
•Provide breach notification records if applicable.
•Provide documentation of privacy incident lessons learned and improvements.

Ask AI

Configure your API key to use AI features.