CA-7, Continuous Monitoring, asks for a system-level strategy with defined metrics, defined monitoring and assessment frequencies, ongoing control assessments, correlation and analysis of results, response actions and status reporting. For a software team that means a short list of metrics you track on a schedule and a record of what you did about them.
What the control requires
The Rev. 5 text lists seven parts. You develop a system-level strategy in line with the organization-level one, and it includes:
- system-level metrics to be monitored
- frequencies for monitoring and for assessing control effectiveness
- ongoing control assessments
- ongoing monitoring of those metrics
- correlation and analysis of assessment and monitoring information
- response actions for the results
- reporting the system's security and privacy status to defined recipients on a defined schedule
The discussion says "continuous" and "ongoing" mean assessing at a frequency sufficient to support risk-based decisions, and different controls may need different frequencies. CA-7 is in the low, moderate and high baselines.
Risk monitoring enhancement
CA-7(4) asks that risk monitoring be part of the strategy with three types: effectiveness monitoring, compliance monitoring and change monitoring. It is in all three baselines in the profiles checked.
A starter metric set
The control leaves the metrics to you. These fit a software system:
- Vulnerabilities. Example metric: Open findings by severity versus the remediation deadline; Related control: RA-5, SI-2
- Inventory. Example metric: Components found running that are not in the inventory; Related control: CM-8
- Change. Example metric: Production changes without an approved review; Related control: CM family
- Integrity. Example metric: Unauthorized change alerts and time to respond; Related control: SI-7
- Assessment. Example metric: Controls assessed this period versus planned; Related control: CA-2
- Exceptions. Example metric: Open exceptions past review date; Related control: CA-5
NIST's program guidance
SP 800-137 describes an information security continuous monitoring program as providing insight into assets, threats and vulnerabilities, and showing whether deployed controls work. It also supports a fast response when they do not. Use it when you need to build the program around the control.
Make it routine
- Write the list of metrics and the owner of each.
- Choose frequencies per metric. Daily for scan data and alerts is common. Control assessments are often slower. The values are yours or your program's.
- Automate the collection. A metric someone must remember to pull will be skipped.
- Hold a short review on a fixed cadence and record decisions.
- Send the status report to the defined recipients and keep a copy.
What auditors look for
A strategy document, metric data over time, a record that someone analyzed it and a trail of actions taken. A dashboard nobody acts on does not satisfy the response and reporting parts.
Try it yourself
Open the continuous monitoring demo and watch how a new finding appears after a change. Look for what gets recorded when the status moves.
Click through it at your own pace, or open it full screen.
Quick check
Does CA-7 say how often to monitor?
No. Frequencies are organization-defined values. The discussion says they must be sufficient to support risk-based decisions.
What are the three types of risk monitoring in CA-7(4)?
Effectiveness monitoring, compliance monitoring and change monitoring.
Safeguard's continuous monitoring of dependencies, asset discovery and compliance and evidence automation supply metric data and retained records. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
