# PM-31 — Continuous Monitoring Strategy

- **Control ID:** PM-31
- **Family:** [PM](/md/families/PM.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: \[assignment\]; Establishing \[assignment\] and \[assignment\] for control effectiveness; Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; Correlation and analysis of information generated by control assessments and monitoring; Response actions to address results of the analysis of control assessment and monitoring information; and Reporting the security and privacy status of organizational systems to \[assignment\] \[assignment\].

## Discussion

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, \[AC-2g\](\#ac-2\_smt.g), \[AC-2(7)\](\#ac-2.7), \[AC-2(12)(a)\](\#ac-2.12\_smt.a), \[AC-2(7)(b)\](\#ac-2.7\_smt.b), \[AC-2(7)(c)\](\#ac-2.7\_smt.c), \[AC-17(1)\](\#ac-17.1), \[AT-4a\](\#at-4\_smt.a), \[AU-13\](\#au-13), \[AU-13(1)\](\#au-13.1), \[AU-13(2)\](\#au-13.2), \[CA-7\](\#ca-7), \[CM-3f\](\#cm-3\_smt.f), \[CM-6d\](\#cm-6\_smt.d), \[CM-11c\](\#cm-11\_smt.c), \[IR-5\](\#ir-5), \[MA-2b\](\#ma-2\_smt.b), \[MA-3a\](\#ma-3\_smt.a), \[MA-4a\](\#ma-4\_smt.a), \[PE-3d\](\#pe-3\_smt.d), \[PE-6\](\#pe-6), \[PE-14b\](\#pe-14\_smt.b), \[PE-16\](\#pe-16), \[PE-20\](\#pe-20), \[PM-6\](\#pm-6), \[PM-23\](\#pm-23), \[PS-7e\](\#ps-7\_smt.e), \[SA-9c\](\#sa-9\_smt.c), \[SC-5(3)(b)\](\#sc-5.3\_smt.b), \[SC-7a\](\#sc-7\_smt.a), \[SC-7(24)(b)\](\#sc-7.24\_smt.b), \[SC-18b\](\#sc-18\_smt.b), \[SC-43b\](\#sc-43\_smt.b), \[SI-4\](\#si-4).

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [GV.OV-01](/md/csf/GV.OV-01.md) — Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
- [GV.OV-02](/md/csf/GV.OV-02.md) — The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
- [GV.SC-03](/md/csf/GV.SC-03.md) — Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
- [GV.SC-09](/md/csf/GV.SC-09.md) — Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
- [GV.SC-10](/md/csf/GV.SC-10.md) — Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
- [ID.IM-02](/md/csf/ID.IM-02.md) — ID.IM-02
- [ID.IM-03](/md/csf/ID.IM-03.md) — Improvements are identified from execution of operational processes, procedures, and activities

## Related controls

- [AC-2](/md/controls/AC-2.md)
- [AC-6](/md/controls/AC-6.md)
- [AC-17](/md/controls/AC-17.md)
- [AT-4](/md/controls/AT-4.md)
- [AU-6](/md/controls/AU-6.md)
- [AU-13](/md/controls/AU-13.md)
- [CA-2](/md/controls/CA-2.md)
- [CA-5](/md/controls/CA-5.md)
- [CA-6](/md/controls/CA-6.md)
- [CA-7](/md/controls/CA-7.md)
- [CM-3](/md/controls/CM-3.md)
- [CM-4](/md/controls/CM-4.md)
- [CM-6](/md/controls/CM-6.md)
- [CM-11](/md/controls/CM-11.md)
- [IA-5](/md/controls/IA-5.md)
- [IR-5](/md/controls/IR-5.md)
- [MA-2](/md/controls/MA-2.md)
- [MA-3](/md/controls/MA-3.md)
- [MA-4](/md/controls/MA-4.md)
- [PE-3](/md/controls/PE-3.md)
- [PE-6](/md/controls/PE-6.md)
- [PE-14](/md/controls/PE-14.md)
- [PE-16](/md/controls/PE-16.md)
- [PE-20](/md/controls/PE-20.md)
- [PL-2](/md/controls/PL-2.md)
- [PM-4](/md/controls/PM-4.md)
- [PM-6](/md/controls/PM-6.md)
- [PM-9](/md/controls/PM-9.md)
- [PM-10](/md/controls/PM-10.md)
- [PM-12](/md/controls/PM-12.md)
- [PM-14](/md/controls/PM-14.md)
- [PM-23](/md/controls/PM-23.md)
- [PM-28](/md/controls/PM-28.md)
- [PS-7](/md/controls/PS-7.md)
- [PT-7](/md/controls/PT-7.md)
- [RA-3](/md/controls/RA-3.md)
- [RA-5](/md/controls/RA-5.md)
- [RA-7](/md/controls/RA-7.md)
- [SA-9](/md/controls/SA-9.md)
- [SA-11](/md/controls/SA-11.md)
- [SC-5](/md/controls/SC-5.md)
- [SC-7](/md/controls/SC-7.md)
- [SC-18](/md/controls/SC-18.md)
- [SC-38](/md/controls/SC-38.md)
- [SC-43](/md/controls/SC-43.md)
- [SI-3](/md/controls/SI-3.md)
- [SI-4](/md/controls/SI-4.md)
- [SI-12](/md/controls/SI-12.md)
- [SR-2](/md/controls/SR-2.md)
- [SR-4](/md/controls/SR-4.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.