Continuous Monitoring for Active Authorizations
An authorization is not a one-time event. Winston & Miller maintains your continuous monitoring program — monthly scan cycles, STIG delta tracking, and POA&M management — so your authorization remains current and your AO has the documentation to sustain it.
Monthly Monitoring Cycle
Scan execution coordination
Coordinate ACAS/Nessus scan scheduling with system administrators, confirm scan coverage, and receive raw output.
Findings review and CAT categorization
Review all scan findings, assign CAT I/II/III severity, deduplicate across assets, and document disposition decisions.
STIG checklist updates for new releases
Review DISA STIG releases since the last cycle, assess delta against current checklists, and triage new CAT I findings for immediate action.
POA&M item tracking and milestone updates
Update open POA&M items with current status, adjust milestones for completed remediation, and flag items approaching scheduled dates.
ConMon report preparation and delivery
Compile findings, trends, and open items into the ConMon report and deliver to the Authorizing Official per command reporting requirements.
Deliverables
Monthly ConMon Report
Status of all open findings, scan trends, STIG compliance percentage.
POA&M Update
Aging items, closed items, new findings, milestone adjustments.
STIG Compliance Summary
Benchmark currency, open CAT I/II/III by asset class.
Change Impact Analysis
Authorization impact for system changes, ECPs, software updates.
When Continuous Monitoring Matters Most
Before scheduled reauthorization
Consolidate evidence, close findings, and prepare the system for the next authorization cycle.
After a significant system change
Impact assessment and authorization update to maintain the integrity of the current ATO.
DISA STIG release cycles
Track new CAT I findings immediately and prevent them from aging without documented disposition.
POA&M aging risk
Prevent milestones from expiring and triggering Authorizing Official concern or adverse findings.
Related White Paper
Continuous Monitoring That Survives the ATO: Building an ISCM Program Under NIST SP 800-137
Continuous monitoring keeps an authorization valid after the ATO letter is signed. Under NIST SP 800-137, an ISCM program defines a strategy, sets a monitoring frequency for each control and metric based on risk, automates collection where possible, reports to the authorizing official, and responds to findings, giving the AO current evidence for ongoing authorization decisions.
Frequently Asked Questions
What is a ConMon report?
A Continuous Monitoring (ConMon) report summarizes the current security posture of an information system for the Authorizing Official. It typically includes open vulnerability counts by severity, STIG compliance percentage, POA&M aging summary, and any significant system changes since the last reporting period. Report format and cadence are established by the AO or command.
How often do you review ACAS scans?
Scan review cadence is established with each client based on command requirements — typically monthly, with ad hoc reviews following significant changes or newly released DISA IAVAs. We review scan results against current DISA benchmarks and document finding disposition.
Can you take over an existing ConMon program?
Yes. We conduct an initial baseline review to understand your current POA&M state, open findings, STIG benchmark currency, and reporting cadence. Transition is typically complete within two to three review cycles.
Keep Your Authorization Current
Discuss Your ConMon Requirements