NIST SP 800-53 (FISMA)

LJK/CDROM™	LJK/Security™
Main Page	Links	Marketing Fluff	What's New

CA-7 Continuous Monitoring

Control: The organization monitors the security controls in the information system on an ongoing basis.

Supplemental Guidance: Continous monitoring activities include configuration management and control of information system components, security impact analyses of changes to the system, ongoing assessment of security controls, and status reporting. The organization establishes the selection criteria for control monitoring and subsequently selects a subset of the security controls employed within the information system for purposes of continuous monitoring. NIST Special Publication 800-37 provides guidance on the continuous monitoring process. NIST Special Publication 800-53A provides guidance on the assessment of security controls.

- excerpted from Recommended Security Controls for Federal Information Systems, US National Institute of Standards and Technology Special Publication 800-53, published February 2005.

LJK/Security™ now comes with starter templates to get you off-and-running as you monitor VMS (OpenVMS) security controls according to NIST SP 800-53 on a regular basis, be it once a day, once an hour, or on differing schedules for various security controls.

Working from that initial base, you can customize to match your organization’s own interpretation of 800-53, adding system-specific exemptions for permitted departures from the general rules established by 800-53.

Violation reports not only specify the nature of the VMS security issue, but also cite the precise NIST 800-53 control identifier applicable to that violation.

By default LJK/Security™ supports Management by Exception, reporting only those controls which are not set in accordance with your policy. Of course you can set up multiple policies, such as the policy you must ultimately follow and an interim policy with which you already comply, allowing separate guidance regarding ultimate progress and possible regression.

Once it has been installed by the system manager, LJK/Security™ can be run by some other individual whose duty is security assessment. That individual does not need to have a username with VMS privileges, preventing any interference with system operations and supporting the AC-5 Separation of Duties control specified by NIST SP 800-53. Since that individual does not have a username with VMS privileges, it also means they do not need training in VMS system management, since they will not have access to system management commands.

Of course LJK/Security™ measures only those controls from 800-53 that are susceptible to analysis from within VMS. Training, Personnel and similar controls must be assessed through human effort, but you will have more time for that if you do not have to concentrate on the Technical controls.

Even for security personnel not involved with the US Federal Government, reading the NIST SP 800-53 document can still be quite helpful, allowing you to compare your own list of security controls to those considered significant by NIST.

LJK/CDROM™	LJK/Security™
Main Page	Links	Marketing Fluff	What's New