An annual audit shows how you looked on one day. CA-7 asks how you look the other 364.
NIST SP 800-53 Rev 5 binds US federal systems, and others through contract. For other organizations it is a reference, and continuous monitoring is increasingly what customers expect to hear about.
What the control asks
Develop a system level continuous monitoring strategy and implement it in line with the organization level strategy. It covers seven things:
- Metrics to be monitored.
- Frequencies for monitoring and for assessing control effectiveness.
- Ongoing control assessments.
- Ongoing monitoring of metrics.
- Correlation and analysis of assessment and monitoring information.
- Response actions based on that analysis.
- Reporting security and privacy status to defined personnel or roles, at a frequency you define.
What it means in practice
NIST's guidance says continuous and ongoing mean assessing and monitoring at a frequency sufficient to support risk based decisions. Different controls need different frequencies. Results should trigger risk response, and if grouped controls fail, a root cause analysis may be needed.
Choose a short set of metrics you will really watch, for example: percentage of systems with logging on, open critical vulnerabilities and their age, overdue access reviews, failed backups, unpatched hosts, training completion. Decide how often each is checked, who reviews, and what triggers action.
The record lists six enhancements: CA-7.1 Independent Assessment, CA-7.2 Types of Assessments, CA-7.3 Trend Analyses, CA-7.4 Risk Monitoring, CA-7.5 Consistency Analysis and CA-7.6 Automation Support for Monitoring. Trend analysis and automation are the most useful early on: charts that show direction, and checks that run without a person remembering.
Evidence to collect
- A written strategy listing metrics, frequencies and owners.
- Dashboards or exported reports with dates.
- Records of automated checks and their results.
- Tickets created from monitoring findings and their closure.
- Periodic status reports to management.
- Records of control assessments run between audits.
Common gaps
- A dashboard with no owner and no thresholds.
- Metrics collected but not tied to action.
- Monitoring of systems only, with no assessment of whether controls work.
- Status reports that stop after the first quarter.
- No trend, so drift goes unseen.
How to implement it
Start with ten metrics, each with an owner, a frequency and a threshold that opens a ticket. Automate collection wherever an API allows it. Report monthly to a named executive. Review the metric list yearly.
Walk through a monitoring loop in the demo.
Click through it at your own pace, or open it full screen.
Try it yourself
Dependencies drift every week as new advisories appear. Run a dependency file through the free in-browser scan at gold.safeguard.sh/scan, note the count, and repeat next month to see why vulnerability metrics belong in CA-7.
Quick check
How continuous is continuous?
Frequent enough to support risk decisions. NIST leaves frequency to you and says it can differ by control type.
Is a quarterly review of a dashboard enough?
Maybe for slow moving controls, but fast moving ones such as vulnerabilities and access changes need tighter cycles with automated alerts.
