NIST SP 800-137 NISTSP137-1: ISCM Strategy, Governance, and Volatility Assessment
Establish Information Security Continuous Monitoring (ISCM) per NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations published September 2011 + companion to NIST SP 800-37 Risk Management Framework + NIST SP 800-53/53A controls + NIST Privacy Framework continuous monitoring. Define ISCM strategy per Section 3.1 covering organisational and system-level objectives + assumptions + constraints + risk tolerance. Conduct security control volatility assessment to identify rapidly-changing controls requiring more frequent monitoring (vulnerability + patching + configuration vs stable controls like physical access). Establish governance structure with Authorising Official + System Owner + ISSO + ISCM Manager.
What else in your programme already covers this
This control maps to 225 controls across 105 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,