thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Continuous Monitoring

Maintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions.

Definition

Information security continuous monitoring (ISCM), defined in NIST SP 800-137, includes defining strategy, establishing metrics and frequencies, implementing collection, analyzing and reporting, responding, and reviewing. It uses automation for continuous diagnostics where possible. It supports ongoing authorization and FedRAMP ConMon.

Example

A FedRAMP provider submits monthly vulnerability scans and POA&M updates to its agency.

Exam tip

ISCM does not mean everything is monitored in real time; frequencies are risk-based.

Related terms