Set a continuous-monitoring cadence from risk and rate of change

Source facts: continuous monitoring is a risk process, not a data volume target

NIST Special Publication 800-137 describes information security continuous monitoring as a strategy and program that provide visibility into organizational assets, threats, vulnerabilities, and the effectiveness of deployed security controls. The resulting information supports timely risk-management decisions and ongoing assurance that controls remain aligned with organizational risk tolerance.

NIST does not define “continuous” as “every control every second.” Monitoring frequencies depend on factors such as security categorization, threat information, vulnerability information, risk assessments, organizational risk tolerance, system and control volatility, control importance, and the ability to respond. Some information may be event-driven or near real time; other evidence may be collected on a scheduled basis.

The publication describes organization-wide, mission or business process, and system levels. An organization-wide strategy can create common metrics and reporting while system-specific implementation addresses local risks and controls. Automation can improve frequency and consistency where it is practical, but automated feeds do not replace analysis, accountability, or monitoring of controls that require human judgment.

DSE recommendation: begin with the decisions monitoring must support

List recurring risk decisions: isolate an asset, accelerate remediation, suspend a supplier connection, revoke an exception, increase review, invoke continuity procedures, or accept continued exposure. For each decision, identify the accountable role, the evidence needed, the time available, and the consequences of a false positive, false negative, or delayed signal.

Map those decisions to risks, controls, assets, and indicators. Useful indicators have a clear definition, population, owner, source, units, threshold, expected range, and response. Distinguish a direct measure—such as tested restoration success—from a proxy, such as backup job completion. Record what the indicator cannot prove.

DSE recommendation: choose frequency from volatility and consequence

Measure the rate of change. Privileged memberships, exposed services, identity policies, critical configurations, and exploitable vulnerabilities can change quickly and may justify event-driven observation.

Consider time to harm. A signal that arrives after the plausible damage window cannot support prevention or containment, even if the monthly report is accurate.

Account for control stability. Stable policies may need less frequent examination than their technical enforcement, exceptions, or operational outcomes.

Include external change. Supplier status, threat intelligence, newly disclosed vulnerabilities, ownership changes, and dependency outages can alter risk without an internal configuration change.

Set a response capacity. Increasing alert frequency without people and authority to act can create an unmanaged backlog. Tune collection and triage together.

DSE recommendation: govern the observation pipeline

Document source systems, coverage, credentials, collection failures, transformations, time synchronization, retention, access, and quality checks. Monitor the monitor: detect stale feeds, excluded assets, broken queries, clock drift, failed agents, and silently changed schemas. Sample raw evidence periodically to verify that dashboard calculations still match the underlying population.

Route threshold breaches into an owned workflow with severity, context, response time, escalation, disposition, and closure evidence. Review trends and individual exceptions; averages can hide one critical asset that has never reported. Periodically reconsider each indicator and cadence after architectural change, incidents, exercises, new threats, or altered risk tolerance.

The program is effective when it reduces uncertainty in time for someone to make a better decision. Retain the strategy, indicator catalog, data-quality evidence, response records, overdue actions, and approved changes. Measure whether alerts lead to timely disposition, whether repeated exceptions change risk decisions, and whether leaders receive the context needed to act. Retire indicators that no longer inform a decision and document the replacement. Those artifacts demonstrate that monitoring is an operating feedback loop rather than a collection of unattended dashboards.

Official references

National Institute of Standards and Technology, SP 800-137: Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 30, 2011; reviewed August 11, 2026.