NIST SP 800-137: Information Security Continuous Monitoring (ISCM), explained

NIST Special Publication 800-137 defines Information Security Continuous Monitoring (ISCM) as "maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions." Published in September 2011 and still listed as "Final" with no superseding revision, it is NIST's guide to building an organization-wide monitoring strategy and program — not a single tool, scan or dashboard, but the strategy, roles and process that decide what gets monitored, how often, and what happens when the data shows a problem.

Why ISCM is a strategy, not a scan

SP 800-137 opens from a simple observation: a one-time authorization to operate, based on evidence from a single point in time, does not stay accurate as systems, threats and environments change. ISCM is the mechanism that keeps that picture current. The document is explicit that organization-wide monitoring "cannot be efficiently achieved through manual processes alone or through automated processes alone" — automated tools (vulnerability scanners, network scanning devices, SIEM feeds) make monitoring more cost-effective and consistent, but many aspects of a mature ISCM program, including interpreting findings and running the response process, still require people.

The six-step ISCM process

Chapter 3 of SP 800-137 lays out the process for developing an ISCM strategy and implementing an ISCM program as six steps:

Step	What it involves
1. Define an ISCM strategy	Grounded in organizational risk tolerance; covers asset visibility, vulnerability awareness, up-to-date threat information and mission/business impact
2. Establish an ISCM program	Determine metrics, status-monitoring frequencies, control-assessment frequencies and the ISCM technical architecture
3. Implement the ISCM program	Collect the security-related information required for metrics, assessments and reporting; automate collection, analysis and reporting where possible
4. Analyze data and Report findings	Analyze collected data, determine the appropriate response, and collect additional information if needed to clarify or supplement it
5. Respond to findings	Technical, management and operational mitigating activities, or a decision to accept, transfer/share, or avoid/reject the risk
6. Review and Update the monitoring program and strategy	Adjust the ISCM strategy and mature measurement capabilities to increase visibility and awareness over time

The document frames this as recursive rather than linear: increased situational awareness from monitoring feeds back into better control of the security processes being monitored, which in turn improves situational awareness.

Three tiers, one program

SP 800-137 mirrors the tiered risk-management view from NIST SP 800-39 and SP 800-37: Tier 1 (Organization) sets risk tolerance, governance and organization-wide metrics; Tier 2 (Mission/Business Processes) translates that into monitoring requirements for specific missions and program-management controls; Tier 3 (Information Systems) runs the system-level assessments and status reporting that feed both higher tiers and the system's own ongoing-authorization decisions. The same monitoring data moves in both directions: policy, metrics and templates flow down from Tiers 1 and 2, while security-status information flows up from Tier 3.

Roles across the ISCM program

SP 800-137 assigns ISCM responsibilities across a defined set of roles, while noting that organizations may rename or combine them: the Risk Executive (Function) oversees the ISCM strategy and reviews status reports against organizational risk tolerance; the Chief Information Officer (CIO) leads the program and secures resources for it; the Senior Information Security Officer (SISO) establishes, implements and maintains the program day to day; the Authorizing Official (AO) applies the program to a specific information system and decides whether its risk remains acceptable; and Information System Owners, Common Control Providers, Information System Security Officers and Security Control Assessors carry out system- and control-level monitoring, assessment and reporting.

Where ISCM sits in the Risk Management Framework

SP 800-137 calls ISCM "a critical step in an organization's Risk Management Framework (RMF)," and its own Figure 2-2 places it at RMF Step 6, Monitor. That figure shows the six-step RMF that was current in 2011 (Categorize, Select, Implement, Assess, Authorize, Monitor); today's RMF, per our SP 800-37 guide, has a seventh step, Prepare, added by Revision 2 in 2018. The ISCM-to-Monitor relationship SP 800-137 describes has not changed — ISCM activities at the information-systems tier are what Step 6 Monitor actually consists of — but the step numbering in SP 800-137's own diagrams reflects the pre-2018 RMF and should not be read as the current step count.

Automation: useful, not sufficient

SP 800-137 recommends organizations favor ISCM tools that pull data from a variety of sources, use open specifications such as the Security Content Automation Protocol (SCAP), interoperate with help desk, inventory, configuration-management and incident-response systems, and allow consolidation into SIEM and dashboard products. It also sets realistic expectations: "it is not possible to fully automate all of an organization's information security program functions," and sampling — assessing a representative subset of systems rather than every asset — is an explicitly sanctioned way to make monitoring practical when full coverage is not cost-effective, provided the sample is chosen to cover enough object types and enough objects per type to be statistically meaningful.

SP 800-137A: assessing the program itself

A separate document, SP 800-137A, published May 2020, answers a different question: not "what should an ISCM program look like," but "how effective is the one we already have." It gives organizations a methodology for assessing their ISCM strategies, policies, procedures, operations and the continuous monitoring data the program actually produces — useful once an ISCM program from SP 800-137 is in place and an organization wants to measure its maturity rather than build it from scratch.

Where this sits next to other NIST guidance

ISCM is the ongoing-awareness layer of a much larger NIST risk-management stack. It feeds and is fed by NIST SP 800-53's control catalog (many SP 800-53 technical controls are the natural candidates for automated ISCM monitoring), supports the RMF's ongoing-authorization decisions, and is a prerequisite for acting on the kind of exploitation and patch-prioritization signals covered in our KEV and EPSS and enterprise patch management guides — none of those signals are useful if an organization cannot first answer, continuously, what it actually has deployed and whether its controls are still effective. For OT-specific monitoring considerations, see our NIST SP 800-82 OT security guide.

A workable starting point

1. Write the strategy before buying tools. SP 800-137's own process starts with Define, not Implement — decide what risk tolerance, metrics and tiers apply before selecting monitoring technology.
2. Pick metrics that trigger a decision, not metrics that are merely easy to collect. A metric that never changes a response action is not worth the collection cost.
3. Use sampling deliberately where full coverage isn't practical, documenting the object types and sample sizes chosen rather than treating partial coverage as an oversight.
4. Review the strategy on a schedule, not just after an incident — SP 800-137 treats Review and Update as a standing step, not a one-time cleanup.

SoftWSP's device and firmware security work can help build the asset-visibility and vulnerability-awareness data an ISCM program needs — continuously, not as a one-time snapshot: see device & firmware security services.

This guide summarises a public NIST publication; it does not constitute legal or compliance advice. SP 800-137 is written for US federal information systems under FISMA but states it may be used voluntarily by other organizations.