NIST: Continuous monitoring can lead to false sense of security

Continuous monitoring of information technology systems does not take the place of system security authorization, says a new FAQ posted to the National Institute of Standards and Technology's webpage on the Federal Information Security Management Act.

"Continuous monitoring in and of itself, does not provide a comprehensive, enterprise‐wide risk management approach," the FAQ states.

Office of Management and Budget guidance in Circular A-130 and the risk management concepts embedded in FISMA require that an authorizing official review and accept the risk of a system "on an ongoing basis," the FAQ states.

Critics of FISMA have pushed for the more continuous and automated monitoring of IT systems, often disapproving of the formal system risk assessment process known as certification and accreditation, calling it a paper-bound and irrelevant exercise.

NASA has told its system administrators that systems already certified and accredited to operate on the agency's network need not be recertified this fiscal year, unless an authorizing official requests it.

But, "continuous monitoring activities contribute to helping authorizing officials make better risk‐based decisions, but do not replace the security authorization process," the NIST FAQ states. Continuous monitoring can result in a false sense of security if the controls are weak of ineffective, the FAQ adds.

"Without the appropriate planning for security controls (preferably early in the system development life cycle) and the correct implementation of those controls, the value of continuous monitoring is greatly diminished," the FAQ states.

NIST is developing additional guidance on continuous monitoring that should be available sometime this summer.

For more:
- the NIST continuous monitoring FAQ (.pdf)
- the NASA memo on suspension of certification and accreditation activity (.pdf)

Related Articles:
House approves FISMA reform
NASA moves away from C&A on IT systems
Federal CISOs: Now give me money