Frameworks / NIST SP 800-137 / NISTSP137-1 NIST SP 800-137
ISCM Strategy
NIST SP 800-137 NISTSP137-1: ISCM Strategy, Governance, and Volatility Assessment Establish Information Security Continuous Monitoring (ISCM) per NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations published September 2011 + companion to NIST SP 800-37 Risk Management Framework + NIST SP 800-53/53A controls + NIST Privacy Framework continuous monitoring. Define ISCM strategy per Section 3.1 covering organisational and system-level objectives + assumptions + constraints + risk tolerance. Conduct security control volatility assessment to identify rapidly-changing controls requiring more frequent monitoring (vulnerability + patching + configuration vs stable controls like physical access). Establish governance structure with Authorising Official + System Owner + ISSO + ISCM Manager.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 191 controls across 96 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CFR211-A-3 Section 211.3 - Definitions CFR211-G-122 Section 211.122 - Materials Examination and Usage Criteria CFR211-G-125 Section 211.125 - Labeling Issuance CFR211-G-130 Section 211.130 - Packaging and Labeling Operations ISO-19650-1-4 Information management concepts ISO-19650-1-5 Delivery team and task team concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO27043-04 Roles and responsibilities definition ISO27043-06 Asset inventory and ownership ISO27043-08 Information classification and labeling ISO27043-10 Media management and disposal ISO21434-04 Roles and responsibilities definition ISO21434-07 Acceptable use of assets ISO21434-08 Information classification and labeling ISO21434-09 Asset handling procedures CPG-2.A Asset Inventory CPG-2.B Prohibit Connection of Unauthorized Devices CPG-6.B Supply Chain Incident Reporting 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 60601-1.7.1 Equipment identification and marking IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles 58.1 Scope 58.3 Definitions AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) ISO-14064-1-5.1 Organizational boundaries ISO-14064-1-5.4 Categorization of indirect GHG emissions ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27010-8.1 Membership Onboarding 27010-8.2 Membership Termination 27011-1 Scope 27011-3 Terms and definitions 27014-1 Scope 27014-3 Terms and definitions 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight C1 Organizational Boundary C3 Scope 1 and 2 Coverage IM8-DAT.1 Data Classification IM8-RES.2 Disaster Recovery API1164-02 Risk Management Framework 4.4.1 Resources, Roles, Responsibility, and Authority AWWA-1.1 Security Policy and Governance AZ-DPA-2 Article 2 - Basic Concepts BSI-15 Security categorization COBIT-BAI02 Managed requirements definition QMSR-820.45 Device labelling and packaging controls (§820.45) FFIEC-05 Roles and responsibilities definition FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality 62351-2 Glossary of terms IEC62443-02 System security categorization ISO-26262-3-5 Item definition ISO28001-PI-01 Personnel Security Screening ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives ISO27019-02 System security categorization 27050-1.4 Terms and definitions 27400-3 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards 2.2.2 2.2.2 Vendor default accounts managed EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) ISMSP-SYS-04 Vulnerability Management PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 FADP-5 Definitions (Article 5) TEFCAREC-1 Common Agreement Conformance and Onboarding 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern USMCADIGITAL-1 Cross-Border Data Flows and Localisation VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 191 it maps to, and the evidence behind each claim, over MCP and REST.