Definitions
CM can be broadly defined by the following:
Continuous monitoring is ongoing observance with intent to provide warning. A continuous
monitoring capability is the ongoing observance and analysis of the operational states of systems
to provide decision support regarding situational awareness and deviations from expectations.
This definition applies to both Cybersecurity and general IT domains (e.g., network management). In this
publication, we focus on the Cybersecurity domains, but the architecture presented is applicable to
general IT domains as well. Because of the effort and expense involved in creating an effective CM
solution, such solutions should be leveraged for as many uses as possible. We strive in this publication to
support use across both Cybersecurity and IT management domains.
To focus on Cybersecurity, we now redefine CM in the context of security risk management using the
NIST Special Publication (SP) 800-137 definition:
Information security continuous monitoring is defined as “maintaining ongoing awareness of
information security, vulnerabilities, and threats to support organizational risk management
decisions.”
Note: The terms “continuous” and “ongoing” in this context mean that security controls and
organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security
decisions to adequately protect organization information.
For purposes of designing a technical reference architecture in this publication, we provide a more
granular and process-focused description. From this we extract essential characteristics for CM
implementations.
Continuous security monitoring is a risk management approach to Cybersecurity that maintains a
picture of an organization’s security posture, provides visibility into assets, leverages use of
automated data feeds, monitors effectiveness of security controls, and enables prioritization of
remedies.
The essential characteristics for CM that can be derived from this definition are the following:
• Maintains a picture of an organization’s security posture
• Measures security posture
• Identifies deviations from expected results
• Provides visibility into assets
• Leverages automated data feeds
• Monitors continued effectiveness of security controls
• Enables prioritization of remedies
• Informs automated or human-assisted implementation of remedies
These characteristics support the EA view of CM provided in Section 3.
NISTIR 7756, Second Draft – January 2012
10
2.2 Scoping and External System Interfaces
It is the intent of the architecture presented in this publication to clearly scope and bound our technical
CM solution. Thus, we make a delineation in our model between what capabilities a technical CM
implementation provides (e.g., providing analysis of events) and the external systems to which it
interfaces. Multiple external systems will interface with any CM capability. For example, CM
implementations must interface with asset management systems for a CM capability to determine what
assets exist.
These external systems and technologies can be categorized to include at least 11 domains (see Figure 1)
that could interface with a CM capability.9
Figure 1. Continuous Monitoring Data Domains
Although the tools supporting these domains are not a core part of the technical CM capability, they need
to be instrumented to interface with CM solutions. For this reason, they are included in our model but are
clearly shown as external entities so that we can describe the needed interface requirements.
9
