CircleID

Studies have found only limited, insufficient agency adherence with FISMA's (Federal Information Security Management Act) continuous monitoring mandates. One survey found almost half of federal IT professionals were unaware of continuous monitoring requirements. A recent GAO report found that two-thirds of agencies "did not adequately monitor networks" to protect them "from intentional or unintentional harm."

To provide senior and staff level cybersecurity professionals with practical guidance in effectively implementing Information Security Continuous Monitoring (ISCM), the Center for Regulatory Effectiveness has released a Best Practices case study of agency compliance with FISMA's continuous monitoring requirements.

Based on NIST FISMA guidance and technical reference documents, CRE developed a set of five continuous monitoring principles. The study documents and explains how a federal agency thwarted an Advance Persistent Threat by adhering to the principles. The study also explains the crucial role of OMB and agency IT leadership in successfully driving agency adoption of continuous monitoring.

The five ISCM Best Practices, in brief, are:

• Principle 1: Aggregate Diverse Data.
• Principle 2: Analyze Multi-Source Data.
• Principle 3: Create Real-Time Data Queries.
• Principle 4: Transform Data Into Actionable Intelligence.
• Principle 5: Maintain Real-Time Actionable Awareness.

The complete study is available, without cost, on CRE's FISMA Focus Interactive Public Docket (www.TheCRE.com/fisma) available here.

By Bruce Levinson, Senior Vice President, Regulatory Intervention

Related topics: Cloud Computing, Policy & Regulation, Security