Date Published: October 2020
Comments Due:
Email Questions to:
Author(s)
Kelley Dempsey (NIST), Victoria Pillitteri (NIST), Chad Baer (DHS), Ron Rudman (MITRE), Robert Niemeyer (MITRE), Susan Urban (MITRE)
Announcement
Draft NIST Interagency Report (NISTIR) 8212 provides an operational approach to the assessment of an organization's information security continuous monitoring (ISCM) program. The ISCM assessment (ISCMA) approach is consistent with the ISCM Program Assessment, as described in NIST SP 800-137A, Assessing ISCM Programs: Developing an ISCM Program Assessment. The ISCMA process proceeds according to the following five steps:
- Plan the approach
- Evaluate the elements
- Score the judgments
- Analyze the results
- Formulate actions
Included with the ISCMA approach in this report is ISCMAx, a free, publicly-available working implementation of ISCMA that can be tailored to fit the needs of the implementing organization. ISCMAx produces a detailed scorecard, associated graphical output, and identifies conditions that may warrant further analysis. The ISCMAx tool is a Microsoft Excel application and can be used in the Windows operating system; it does not run on the Macintosh operating system. NISTIR 8212 provides complete instructions for both using ISCMAx as provided, and for tailoring ISCMAx, if desired.
See the Supplemental Material on this page for two ISCMAx tool macro-enabled spreadsheets, for Recommended Judgments and Alternate Judgments. For instructions on how to use those workbooks, please refer to Sections 3, 4, and 5 of Draft NISTIR 8212.
We encourage you to use the comment template for organizing and submitting your comments.
NOTE: A call for patent claims is included on page vi of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
This publication describes an example methodology for assessing an organization’s Information Security Continuous Monitoring (ISCM) program. It was developed directly from NIST guidance and is applicable to any organization, public or private. It can be used as documented or as the starting point for a different methodology. Included with the methodology is a reference implementation that is directly usable for conducting an ISCM assessment.
This publication describes an example methodology for assessing an organization’s Information Security Continuous Monitoring (ISCM) program. It was developed directly from NIST guidance and is applicable to any organization, public or private. It can be used as documented or as the starting point...
See full abstract
This publication describes an example methodology for assessing an organization’s Information Security Continuous Monitoring (ISCM) program. It was developed directly from NIST guidance and is applicable to any organization, public or private. It can be used as documented or as the starting point for a different methodology. Included with the methodology is a reference implementation that is directly usable for conducting an ISCM assessment.
Hide full abstract
Keywords
assessment; continuous monitoring; information security continuous monitoring; information security continuous monitoring assessment; ISCM; ISCMA; ISCMAx
Control Families
None selected
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
