Instructor: Now we're going to move on 2 2
to step number seven, which is called monitor. 3 3
And it's the last step in the risk management framework. 4 4
The purpose of the monitor step is to maintain awareness 5 5
about the security and privacy posture of your system. 6 6
You'll use a strategy of continuous monitoring 7 7
during this step. 8 8
Your organization's system and environment 9 9
will inevitably change in some way, 10 10
whether it's changes in software, staff, your facility, 11 11
or the way adversaries are trying to exploit your system. 12 12
So I want you to be on the lookout for unauthorized changes, 13 13
and if you find them, be sure to get to the bottom of it. 14 14
When you complete Task M-1, 15 15
you'll have updated security and privacy plans, 16 16
updated plans of action and milestones, 17 17
which is called the POAM, 18 18
and you'll have updated security 19 19
and privacy assessment reports. 20 20
In Task M-2 you'll assess the controls in the system, 21 21
very similar to the way you did during the assess step. 22 22
After your initial system or control authorization, 23 23
you'll have to assess all controls on an ongoing basis. 24 24
Assessing control effectiveness 25 25
is part of continuous monitoring. 26 26
Control assessment should continue 27 27
as information you generate from continuous monitoring 28 28
is correlated, analyzed and reported to senior officials. 29 29
If you have to satisfy the annual FISMA 30 30
security assessment requirement, 31 31
you can use the assessment results 32 32
from your continuous monitoring. 33 33
During continuous monitoring 34 34
you'll probably run into more risks. 35 35
Task M-3 will end with mitigation actions 36 36
or risk acceptance decisions, 37 37
which you'll document in your security and privacy reports. 38 38
Assessments done during continuous monitoring 39 39
should be provided to the system owner 40 40
and common control provider. 41 41
The authorizing official will determine 42 42
the best risk response to the new assessment findings 43 43
or they may approve whatever the system owner proposes 44 44
as a solution. 45 45
Then the system owner will implement 46 46
the appropriate risk response. 47 47
When you complete task M-4, 48 48
you'll have an updated security and privacy report 49 49
detailing the findings from Task M-3. 50 50
Now, to achieve near realtime risk management 51 51
your organization will have to update 52 52
security and privacy plans, assessment reports, 53 53
and plans of action and milestones on an ongoing basis. 54 54
The frequency of these updates 55 55
is at the discretion of the system owner, 56 56
common control provider, and authorizing official. 57 57
Make sure to track changes 58 58
in your security and privacy plans 59 59
throughout your continuous monitoring. 60 60
In Task M-5 you'll report 61 61
the system security and privacy posture 62 62
to your authorizing official. 63 63
All of the documents that were updated 64 64
in the authorization package back in Task M-4 65 65
will be reported to the authorizing official 66 66
on an ongoing basis. 67 67
This reporting can be event driven, time driven, 68 68
or a combination of both, 69 69
this means that you can either report when something happens 70 70
or if a certain amount of time has passed, 71 71
how your report is written and formatted 72 72
is up to you and your organization, 73 73
with the ultimate goal being to effectively communicate 74 74
your security and privacy posture 75 75
to your authorizing official. 76 76
At a minimum, you should summarize changes 77 77
to security and privacy plans, assessment reports, 78 78
and plans of action and milestones since the last report. 79 79
The goal of Task M-6 80 80
is to have an ongoing authorization process, 81 81
along with assessing and reporting. 82 82
Your authorizing official will also have to authorize 83 83
all the ongoing changes 84 84
and your security privacy posture. 85 85
Task M-7 is the last task in the monitoring step. 86 86
When you complete task M-7 87 87
you'll have a system disposal strategy. 88 88
Several risk management actions are required 89 89
when putting a system out of commission. 90 90
Controls addressing system disposal have to be implemented 91 91
such as media sanitization, 92 92
configuration management and control, 93 93
component authenticity, and record retention. 94 94
Organizational tracking and management systems, 95 95
like inventory systems, will need to be updated to show 96 96
that the system is being disposed of. 97 97
Users and application owners hosted on the system 98 98
have to be notified in a timely manner, 99 99
and security and privacy reports must be updated. 100 100
I want you to ensure that your disposal 101 101
complies with federal laws, regulations, 102 102
directives, policies, and standards.