NIST 800-53 CA-7

Continuous Monitoring

Return to master list of NIST 800-53 controls.

Automated Inspection items for NIST SP 800-53 CA-7 assessment.

Automated Inspection items are efficient enough that they can usually be part of a CA-7 Continuous Monitoring program on a daily (or in some cases hourly) basis, simultaneously meeting the requirements of RA-5 Vulnerability Scanning. While NIST 800-53 allows Continuous Monitoring results to be used for CA-2 Security Assessments and CA-4 Security Certification, a separate run using the same automated Inspection items in combination with more laborious items for CA-2 and CA-4 adds no significant burden.

Depending on FIPS 199 impact level and whether the Industrial Control Systems (ICS/SCADA) subset of 800-53 is chosen,  LJK/Security™ starter templates provide automated Inspection items as follows:

NIST SP 800-53 R2 CA-7
Description  Automated Tests
Continuous Monitoring and Vulnerability Detection are conducted.
(USAGE,ASSESSMENT,CONTINUING)
LJK/Security starts whenever the system boots.
(VMS,STARTUP,MUSTHAVE)
Other cluster members have been assessed according to schedule.
(USAGE,ASSESSMENT,CLUSTER)
Plan of Action and Milestones is generated at least annually.
(USAGE,REMEDIATE,MINIMUM)

Interview questions for NIST SP 800-53 CA-7 assessment.

Interview questions are useful mainly for CA-2 Security Assessments and CA-4 Security Certification. For most environments they are too laborious to include in CA-7 Continuous Monitoring.

Depending on FIPS 199 impact level and whether the Industrial Control Systems (ICS/SCADA) subset of 800-53 is chosen,  LJK/Security™ starter templates provide Interview questions in the following groups:

Determination Statement Number Group Names
NIST SP 800-53 R2 CA-7
APPLICATION
AUDIT
HARDWARE
NETWORK
SYSTEM
NIST SP 800-53 R2 CA-7(1)
ASSESSMENT

Manual Inspection items for NIST SP 800-53 CA-7 assessment.

Manual Inspection items are useful mainly for CA-2 Security Assessments and CA-4 Security Certification. For most environments they are too laborious to include in CA-7 Continuous Monitoring.

Depending on FIPS 199 impact level and whether the Industrial Control Systems (ICS/SCADA) subset of 800-53 is chosen,  LJK/Security™ starter templates provide Manual Inspection items in the following groups:

Determination Statement Number Group Names
NIST SP 800-53 R2 CA-7
POLICY
NIST SP 800-53 R2 CA-7(1)
ASSESSMENT

Descriptions above apply to  LJK/Security™ Version 3.0.

The notation NIST SP 800-53 above refers in particular to NIST Special Publication 800-53 Revision 2.

Those NIST Special Publications specify security standards in support of FISMA for US Federal Government civil activities.

Return to master list of NIST 800-53 controls.

Valid HTML 4.01! Viewable with Any Browser