|

controlCA-7

Continuous Monitoring (CA-7)

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:

Security Baselines

LOWMODERATEHIGH

assessmentauthorizationmonitoring

Why These Connect

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports63

These related controls work together — a change to one may affect the others.

Mitigates19

This control helps defend against or reduce the risk of the linked threat technique.

Enhances6

These enhancements add specific capabilities or refinements to the base control.

Related Controls(55)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

CA-2Control Assessments (CA-2)

CA-5Plan of Action and Milestones (CA-5)

CA-6Authorization (CA-6)

AC-2Account Management (AC-2)

AC-6Least Privilege (AC-6)

AC-17Remote Access (AC-17)

AT-4Training Records (AT-4)

AU-13Monitoring for Information Disclosure (AU-13)CM-3Configuration Change Control (CM-3)

CM-4Impact Analyses (CM-4)

CM-6Configuration Settings (CM-6)

CM-11User-installed Software (CM-11)

IA-5Authenticator Management (IA-5)

IR-5Incident Monitoring (IR-5)

MA-2Controlled Maintenance (MA-2)

MA-3Maintenance Tools (MA-3)

MA-4Nonlocal Maintenance (MA-4)

PE-3Physical Access Control (PE-3)

PE-6Monitoring Physical Access (PE-6)

PE-14Environmental Controls (PE-14)

PE-16Delivery and Removal (PE-16)

PE-20Asset Monitoring and Tracking (PE-20)PL-2System Security and Privacy Plans (PL-2)

PM-4Plan of Action and Milestones Process (PM-4)PM-6Measures of Performance (PM-6)PM-9Risk Management Strategy (PM-9)PM-10Authorization Process (PM-10)PM-12Insider Threat Program (PM-12)PM-14Testing, Training, and Monitoring (PM-14)PM-23Data Governance Body (PM-23)PM-28Risk Framing (PM-28)PM-31Continuous Monitoring Strategy (PM-31)PS-7External Personnel Security (PS-7)

PT-7Specific Categories of Personally Identifiable Information (PT-7)RA-3Risk Assessment (RA-3)

RA-5Vulnerability Monitoring and Scanning (RA-5)

RA-7Risk Response (RA-7)

RA-10Threat Hunting (RA-10)SA-8Security and Privacy Engineering Principles (SA-8)

SA-9External System Services (SA-9)

SA-11Developer Testing and Evaluation (SA-11)

SC-5Denial-of-service Protection (SC-5)

SC-7Boundary Protection (SC-7)

SC-18Mobile Code (SC-18)

SC-38Operations Security (SC-38)SC-43Usage Restrictions (SC-43)SI-3Malicious Code Protection (SI-3)

SI-4System Monitoring (SI-4)

SI-12Information Management and Retention (SI-12)

SR-6Supplier Assessments and Reviews (SR-6)

PM-32Purposing (PM-32)SA-24Design For Cyber Resiliency (SA-24)SC-28Protection of Information at Rest (SC-28)

SI-6Security and Privacy Function Verification (SI-6)

Threat Coverage(19 ATT&CK techniques)

T1566Phishing T1190Exploit Public-Facing Application T1204User Execution T1562Impair Defenses T1036Masquerading T1046Network Service Discovery T1018Remote System Discovery T1570Lateral Tool Transfer T1071Application Layer Protocol T1573Encrypted Channel T1105Ingress Tool Transfer T1041Exfiltration Over C2 Channel T1567Exfiltration Over Web Service T1048Exfiltration Over Alternative Protocol T1499Endpoint Denial of Service T1498Network Denial of Service T1598Phishing for Information T1583Acquire Infrastructure T1588Obtain Capabilities

Control Enhancements(6)

CA-7(1)Independent Assessment (CA-7(1))

CA-7(2)Types of Assessments (CA-7(2))W

CA-7(3)Trend Analyses (CA-7(3))

CA-7(4)Risk Monitoring (CA-7(4))

CA-7(5)Consistency Analysis (CA-7(5))

CA-7(6)Automation Support for Monitoring (CA-7(6))

See Also

@SP 800-53 Overview ⚖Compare Baselines