800-53 · CA Assessment, Authorization and Monitoring
CA-7
Continuous Monitoring
frameworkNIST SP 800-53 Rev 5.2
sectionCA Assessment, Authorization and Monitoring
csf 2.0DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-02 DE.CM-03 DE.CM-06 DE.CM-09 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-07
topicsCont. Monitoring
frameworks7 3 0
Official textDevelop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;
c. Ongoing control assessments in accordance with the continuous monitoring strategy;
d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
e. Correlation and analysis of information generated by control assessments and monitoring;
f. Response actions to address results of the analysis of control assessment and monitoring information; and
g. Reporting the security and privacy status of the system to [Assignment: organization-defined organization-defined personnel or roles] [Assignment: organization-defined organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)
a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;
c. Ongoing control assessments in accordance with the continuous monitoring strategy;
d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
e. Correlation and analysis of information generated by control assessments and monitoring;
f. Response actions to address results of the analysis of control assessment and monitoring information; and
g. Reporting the security and privacy status of the system to [Assignment: organization-defined organization-defined personnel or roles] [Assignment: organization-defined organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-01DE.CM-03DE.CM-09 | Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events… | Crosswalk | Same topic: Cont. Monitoring6 loosely related (not mappings)DE.AE-02 Potentially adverse events are analyzed to better understand associated activities Only shares CSF DE.AE-02: related, not a mapping DE.AE-03 Information is correlated from multiple sources Only shares CSF DE.AE-03: related, not a mapping DE.CM-02 The physical environment is monitored to find potentially adverse events Only shares CSF DE.CM-02: related, not a mapping DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Only shares CSF DE.CM-06: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Only shares CSF ID.RA-01: related, not a mapping ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked Only shares CSF ID.RA-07: related, not a mapping |
| ISO 27001 | A.8.16A.5.36Clause 9.1Clause 9.2.2Clause 9.3.2Clause 9.3.3 | Monitoring activities; Compliance with policies, rules and standards for information security… | Crosswalk | Same topic: Cont. Monitoring NIST SP 800-53 → ISO 27001 mapping 11 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF DE.CM-06: related, not a mapping A.5.24 Information security incident management planning and preparation Only shares CSF DE.AE-02: related, not a mapping A.5.25 Assessment and decision on information security events Only shares CSF DE.AE-02: related, not a mapping …and 3 more in the downloads |
| CIS v8.1 | CIS 13.1CIS 13.6 | Centralize Security Event Alerting; Collect Network Traffic Flow Logs | Crosswalk | Same topic: Cont. Monitoring48 loosely related (not mappings)CIS 10.7 Use Behavior-Based Anti-Malware Software Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping CIS 7.1 Establish and Maintain a Vulnerability Management Process Only shares CSF ID.RA-01: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF DE.CM-06: related, not a mapping CIS 13.2 Deploy a Host-Based Intrusion Detection Solution Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping CIS 13.3 Deploy a Network Intrusion Detection Solution Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping …and 40 more in the downloads |
| SOC 2 | CC7.2 | Monitoring system components for anomalies | Editorial | Same topic: Cont. Monitoring (editorial pick)6 loosely related (not mappings)CC6.6 Protection against threats from outside system boundaries Only shares CSF DE.CM-01: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF DE.CM-09: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Only shares CSF ID.RA-01: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Only shares CSF DE.AE-03: related, not a mapping |
| PCI DSS | 10.4.1 | Security event and critical logs reviewed daily | Crosswalk | Same topic: Cont. Monitoring36 loosely related (not mappings)10.2.1 Audit logs enabled and active Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping 11.3.2 External ASV scans every three months Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF DE.AE-02, ID.RA-01: related, not a mapping 10.3.3 Logs promptly backed up to a central server Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Only shares CSF DE.AE-02, ID.RA-07: related, not a mapping …and 28 more in the downloads |
| CMMC | SI.L2-3.14.6SI.L2-3.14.7CA.L2-3.12.1CA.L2-3.12.2CA.L2-3.12.3CA.L2-3.12.4CM.L2-3.4.9 | Monitor Communications for Attacks; Identify Unauthorized Use… | Crosswalk | Same topic: Cont. Monitoring NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.12.03 → SP 800-53 30 loosely related (not mappings)IR.L2-3.6.1 Incident Handling Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping RA.L2-3.11.1 Risk Assessments Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SC.L2-3.13.2 Security Engineering Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CM.L2-3.4.3 System Change Management Only shares CSF DE.CM-01, DE.CM-09, ID.RA-07: related, not a mapping …and 22 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(D)§164.308(a)(8) | Information System Activity Review; Evaluation | Crosswalk | Same topic: Cont. Monitoring NIST HIPAA → SP 800-53 crosswalk 36 loosely related (not mappings)§164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09…: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, ID.IM-01…: related, not a mapping §164.308(a)(3) Workforce Security Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(4) Information Access Management Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping …and 28 more in the downloads |
| GDPR | Art.28(1)Art.28(3)Art.29Art.32(1)(d) | Processor; Processor… | No mapping. Only shares CSF DE.CM-06, DE.CM-03, ID.RA-01: related, not a mapping+1 more loosely related (not mappings) | |
| NIS2 | 3.2 | Monitoring and logging | Crosswalk | Same topic: Cont. Monitoring10 loosely related (not mappings)6.9 Protection against malicious and unauthorised software Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping …and 2 more in the downloads |
| Essential Eight | ISM-0109ISM-1906ISM-1907 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber…… | Editorial | Same topic: Cont. Monitoring (editorial pick)41 loosely related (not mappings)ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.AE-02, DE.AE-03, DE.CM-09: related, not a mapping ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-0843 Application control is implemented on workstations Only shares CSF DE.CM-09: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF DE.CM-09: related, not a mapping ISM-1490 Application control is implemented on internet-facing servers Only shares CSF DE.CM-09: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01: related, not a mapping ISM-1509 Privileged access events are centrally logged Only shares CSF DE.AE-03: related, not a mapping …and 33 more in the downloads |
| DORA | Art.9(1)Art.10(3) | Protection and prevention; Detection | Editorial | Same topic: Cont. Monitoring (editorial pick) |
| CPS 234 | Para 23Para 16Para 17Para 22 | Detect and respond to incidents in a timely manner; Assess third parties' information security capability… | No mapping. Only shares CSF DE.AE-02, DE.CM-01, DE.CM-06, ID.RA-01: related, not a mapping+4 more loosely related (not mappings)Para 27 Systematic testing programme for control effectiveness Only shares CSF ID.RA-01: related, not a mapping Para 28 Check third parties' control testing is adequate Only shares CSF DE.CM-06: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Only shares CSF ID.RA-01: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF DE.CM-06: related, not a mapping | |
| Cyber Essentials | CE 3CE 5 | Security Update Management; Malware protection | No mapping. Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.