PM-31, Continuous Monitoring Strategy, asks you to develop an organization wide strategy and put monitoring programs in place. It lists six elements: the metrics to monitor, the frequencies for monitoring and for assessing control effectiveness, ongoing monitoring of those metrics, correlation and analysis of what you learn, response actions, and reporting of status to defined recipients.
800-53 binds federal systems and others by contract. For other organizations it is a template for the monitoring section of a security program, and a good answer to the question: how do you know your controls still work?
What it means in practice
The record explains the vocabulary. Continuous and ongoing mean assessing and monitoring controls and risks often enough to support risk based decisions. Different controls can need different frequencies. A firewall rule set might be checked daily and a policy review once a year.
Results guide risk response. The record says reports and dashboards that give timely access to security and privacy information help officials make informed decisions, including ongoing authorization decisions. It suggests aligning monitoring metrics with the risk tolerance from the risk management strategy (PM-9, PM-28). The record also notes that other controls reference monitoring needs, so this strategy is where those scattered requirements come together.
To build one, start with a table. For each metric: what it measures, the source, the frequency, the threshold that triggers action, the owner, and where it is reported. Examples include share of cloud accounts passing configuration checks, open critical vulnerabilities past their due date, share of systems with backups tested, and access review completion.
The verbs in the statement matter. Correlate and analyze means you look at results together, not each tool in isolation. Response actions means a threshold crossing leads to a ticket and an owner, not just a red cell on a dashboard.
Automation helps with the frequency problem. Manual evidence collection once a quarter cannot be called continuous. Automated tests that run on a schedule and keep their results give you a record an auditor can sample.
Evidence to collect
- The continuous monitoring strategy document
- The metrics table with frequencies and thresholds
- Dashboards or reports with dates
- Records of analysis, such as review meeting notes
- Tickets created from threshold breaches
- Reports delivered to the defined recipients
- Strategy review history
Common gaps
- Metrics were chosen because a tool provides them, not because of risk
- Frequencies are not written down
- Alerts fire with no owner
- Different tools disagree and nobody reconciles them
- Reporting is done only before audits
How to implement it
- Derive metrics from your risk tolerance and your top risks.
- Set frequency and thresholds per metric.
- Automate collection and keep history.
- Route breaches into the POA&M process (PM-4).
- Report to leadership monthly and review the metric set each year.
See it in a demo
Click through it at your own pace, or open it full screen.
Quick check
What six elements does PM-31 list?
Metrics, frequencies for monitoring and assessment, ongoing monitoring, correlation and analysis, response actions, and reporting.
Does continuous mean real time?
No. The record says it means often enough to support risk based decisions, and frequencies can differ by control.
