Continuous Monitoring That Survives the ATO: Building an ISCM Program Under NIST SP 800-137

An authorization decision is based on evidence that starts aging the day it is collected. Patches are released, configurations drift, staff change roles, interfaces are added, and new threats make old assumptions wrong. A system that was acceptable at assessment can become unacceptable without anyone deciding that it should.

Programs that treat continuous monitoring as a monthly scan upload experience a familiar cycle: the package goes stale, the reauthorization becomes a full reassessment, and the team rebuilds artifacts it already produced once. Information security continuous monitoring (ISCM), as NIST SP 800-137 defines it, is the alternative: maintaining ongoing awareness of information security, vulnerabilities, and threats so that risk decisions are made on current information.

The policy basis in DoD is explicit. DoDI 8510.01 requires continuous monitoring in accordance with OMB M-14-03, NIST SP 800-137 and 800-137A, and the DoD instructions on cybersecurity activities and vulnerability management. It also makes ongoing authorization a task in the Monitor step: authorizing officials conduct ongoing authorizations using the results of continuous monitoring.

NIST SP 800-137 describes a six-step process. It applies at three tiers: the organization, the mission or business process, and the individual system. A Navy program office usually operates at the system tier while inheriting tier 1 and tier 2 decisions from its command and component.

The steps are easy to list and easy to skip. The most commonly skipped is the sixth. A monitoring strategy written for an initial ATO and never revisited will keep measuring what mattered at assessment, not what matters now.

NIST deliberately avoids prescribing a single frequency. SP 800-137 states that monitoring frequencies are neither static nor uniform across metrics, and it lists criteria to weigh when setting them:

• Control volatility. Controls likely to change often, such as configuration settings (CM-6) and component inventory (CM-8), are assessed more frequently.
• System categorization. Controls on higher-impact systems generally warrant more frequent monitoring.
• Controls providing critical functions. Controls whose failure would cause outsized harm get more attention.
• Controls with known weaknesses. Items already on the POA&M are watched more closely until closed.
• Organizational risk tolerance. Lower tolerance means higher frequency.
• Threat and vulnerability information. Current intelligence can raise the frequency for affected controls.
• Risk assessment results and strategy reviews. Both feed back into the schedule.
• Reporting requirements. These set minimums, but NIST is clear that reporting does not drive the ISCM strategy.

Translate those criteria into a frequency matrix the AO's staff can read in one page. The example below is illustrative; your frequencies should come from your own strategy, your component's requirements, and your AO's direction.

SP 800-137 expects metrics that give recipients visibility into assets, awareness of vulnerabilities, and knowledge of threats. In practice, AO staff need a small number of measures that change when risk changes. Counts of scans run do not qualify. Useful system-level measures include:

• Exposure age. Days that critical and high vulnerabilities have remained open, compared with the remediation timelines your organization has set.
• Configuration compliance. Percentage of in-scope components passing the applicable benchmark, with the failing checks named.
• Inventory accuracy. Discovered assets not in the authorized inventory, and inventory entries not seen on the network.
• POA&M health. Items past their milestone date, items whose dates moved this period, and items closed with evidence.
• Evidence currency. Share of controls whose most recent evidence falls within the age limit the strategy sets.

Each metric should have a threshold and an owner. A number without a threshold is a statistic; a number with a threshold and an owner is a control.

Evidence freshness is the operational form of monitoring frequency. For every control, the strategy should state the maximum age of the evidence that supports it. Evidence older than that limit means the control's status is unknown, which should be reported as such rather than presumed satisfied.

Making freshness visible

• Record a collection date with every artifact, in eMASS or your system of record, not just in a file name.
• Report controls with expired evidence alongside controls with failed checks; both represent unknown or degraded assurance.
• Prefer evidence generated by the system itself, such as configuration exports or scan output, over screenshots, which are hard to date and easy to misread.
• Reuse evidence across controls and across authorizations where NIST SP 800-53A and your AO allow it, rather than collecting the same data twice.

Ongoing authorization is the RMF mechanism in NIST SP 800-37 Rev 2 and DoDI 8510.01. Once a system is authorized and a robust continuous monitoring program is in place, the AO uses monitoring results to decide, on an ongoing basis, whether risk remains acceptable. It applies to any system with a mature ISCM program.

Continuous authorization to operate (cATO) is a DoD designation for systems built and operated with DevSecOps practices. A DoD memorandum signed February 2, 2022 by the DoD Senior Information Security Officer requires the AO to demonstrate three competencies:

1. Continuous monitoring of RMF controls, with visibility into cybersecurity activity inside the boundary.
2. Active cyber defense, meaning the ability to respond to threats in real time.
3. Adoption and use of an approved DevSecOps reference design.

The memo expects controls to feed a system-level dashboard, routes requests through the component CISO to the DoD CISO for approval, and states that approved cATOs do not carry an expiration date but can be revoked. DoD CIO has since published evaluation criteria organized around continuous monitoring, active cyber defense, and the secure software supply chain, including authorization of the DevSecOps platform, the process, and the people.

For most Navy programs, ongoing authorization is the realistic target and the necessary foundation. A program that cannot sustain ISCM will not qualify for cATO, and a program with strong ISCM gains most of the operational benefit even without the designation.

Automate the data that changes fastest and is most expensive to collect by hand: vulnerability scanning, configuration compliance, asset discovery, and log collection. These four feeds support a large share of technical controls and are the ones most likely to be stale when gathered manually.

Then automate the connective tissue: mapping tool output to control identifiers, timestamping evidence, opening and updating POA&M items from findings, and producing the AO's recurring report. Machine-readable formats such as NIST's OSCAL can reduce the translation effort between tools and documentation.

Some controls should stay manual on purpose. Policy reviews, contingency exercises, and interviews with people who perform a process are assessments of judgment and behavior. Automating their paperwork is useful; pretending to automate the assessment is not.

To check the program itself, NIST SP 800-137A provides a method for assessing an ISCM program, and NISTIR 8212 describes a free implementation of that assessment.