An authorization under NIST SP 800-53 is a decision made at a point in time. The system it covered starts changing the next morning. Continuous monitoring is how you show, between assessments, that the controls still work and the risk the authorizing official accepted is still the risk you are running.
Teams often hear "continuous monitoring" and think of a security monitoring tool. That is part of it, but the control asks for something broader: a strategy, chosen metrics, assessment frequencies, analysis, response, and reporting. This article covers what CA-7 requires, how to set frequencies you can defend, which controls feed the program, and how monitoring results become decisions.
What CA-7 asks for
CA-7, Continuous Monitoring, asks you to develop a system-level continuous monitoring strategy and run monitoring in line with the organization-level strategy. Its parts, in summary, require:
Metrics. Organization-defined system-level metrics to monitor.
Frequencies. Organization-defined frequencies for monitoring, and for assessing control effectiveness.
Ongoing control assessments, according to the strategy.
Ongoing monitoring of the defined metrics.
Correlation and analysis of what assessments and monitoring produce.
Response actions to address the results of that analysis.
Reporting the security and privacy status of the system to defined personnel at a defined frequency.
Read as a whole, CA-7 describes a loop: measure, analyze, respond, report. A tool that collects data covers the first step. The control is met only when the other three happen on a schedule and leave records.
CA-7 has enhancements as well. CA-7(4), Risk Monitoring, asks that monitoring cover effectiveness of controls, compliance with requirements, and changes to the system and its environment. Check your baseline in NIST SP 800-53B for which enhancements apply to you.
The organization-level strategy
CA-7 assumes an organization-wide strategy exists for the system strategy to follow. In Rev. 5 that sits in the Program Management family, as PM-31, Continuous Monitoring Strategy.
NIST SP 800-137, the guide to information security continuous monitoring, describes the process for building one:
Define the strategy, grounded in the organization's risk tolerance.
Establish the program: metrics, frequencies, and the technical architecture.
Implement it, collecting the data and running the assessments.
Analyze the data and report findings.
Respond, by mitigating, accepting, transferring, or avoiding the risk.
Review and update the strategy and program.
For a smaller organization with one authorized system, the organization-level and system-level strategies can be one document. Make sure it says so, so an assessor does not go looking for a second one.
Setting monitoring frequencies
Frequency is where most strategies are weakest. A strategy that says every control is assessed annually is not wrong, but it is not monitoring either.
Set frequencies by asking how fast a control can fail without anyone noticing. Factors NIST SP 800-137 discusses include how volatile a control is, the system's impact level, whether the control provides critical protection, and whether it has a history of weaknesses.
| Control type | How it fails | A defensible approach |
|---|---|---|
| Configuration settings | Drift with every change | Automated checks against the baseline, frequent |
| Vulnerabilities | New ones are published constantly | Scheduled authenticated scanning, plus scans after significant change |
| Accounts and access | Joiners, movers, leavers | Automated account monitoring, with periodic review |
| Logging and alerting | Sources stop sending without alarm | Automated checks that each source is reporting |
| Policies and plans | Slowly fall out of date | Annual review, or on significant change |
| Physical controls | Rarely change | Less frequent assessment, often inherited |
The values are yours to set, but a reviewer will expect volatile, automatable controls to be checked far more often than stable, procedural ones. Write the reasoning next to each frequency. "Weekly, because configuration changes deploy daily and drift is the most common failure" is a defensible line.
The controls that feed the program
Continuous monitoring draws on controls across the catalog. The ones that usually do the most work:
CM-8, System Component Inventory. You cannot monitor what you have not listed. Inventory accuracy is the first metric to track.
CM-2 and CM-6, Baseline Configuration and Configuration Settings. The reference that drift is measured against.
RA-5, Vulnerability Monitoring and Scanning. Scanning results, and the timeliness of remediation against your own deadlines. Our article on vulnerability SLAs auditors accept covers how to set those deadlines.
SI-4, System Monitoring. Detection of attacks and unauthorized use.
AU-6, Audit Record Review, Analysis, and Reporting. Evidence that someone looks at the logs, not only that logs exist.
CA-2, Control Assessments. The scheduled assessments CA-7 calls for.
CA-5, Plan of Action and Milestones. Where weaknesses found by monitoring go, and where their remediation is tracked.
If you are unfamiliar with the families these come from, our overview of the control families explains how they fit together.
From monitoring to decisions
Monitoring that produces only dashboards does not meet CA-7. The control expects analysis, response, and reporting, and each should leave a record.
Analysis. Someone reviews the results on a schedule and correlates them. A failed configuration check and a new vulnerability on the same component are more serious together than apart.
Response. Each finding gets a decision: fix it within the deadline, add it to the plan of action and milestones, or escalate it for risk acceptance by someone with authority to accept it. Unremediated findings with no recorded decision are exactly what assessors look for.
Reporting. CA-7 requires reporting security and privacy status to defined roles at a defined frequency. For an authorized system, the authorizing official is usually one of them. A short, regular report with trends, open items, and significant changes is more useful than a long, irregular one.
NIST SP 800-37 Rev. 2 describes ongoing authorization, in which an authorizing official relies on continuous monitoring results to keep an authorization in force rather than repeating a full assessment on a fixed cycle. That is only possible when monitoring is mature and reported well. It is the long-term payoff for doing CA-7 properly.
Significant changes are the other trigger. A new interconnection, a new hosting environment, or a major architectural change can require a security impact analysis and possibly reassessment, whatever the monitoring schedule says. Define in your strategy what counts as significant, so the decision is not made case by case under deadline pressure.
Mistakes that make monitoring look weaker than it is
Equating a tool with the program. A monitoring platform is a source of data. The strategy, frequencies, analysis, and reporting are the program.
Frequencies nobody meets. Stating monthly assessments and producing three a year is a finding. State what you will do, then do it.
Monitoring only technical controls. Procedural controls, such as training completion or access reviews, need monitoring too, even if less often.
No link to the plan of action. Findings that never reach CA-5 look like findings nobody acted on.
Reports with no audience. If nobody with authority reads the status report, part (g) is met on paper only.
Our NIST 800-53 framework page covers how CA-7 fits with the other assessment and authorization controls.
How TrustLynce helps
TrustLynce runs control checks against connected cloud, identity, HR, and code systems on a schedule and routes failures to the owning team, with a record of each result. That gives you the measurement and response history CA-7 asks for. See continuous monitoring.