SP 800-137 ISCM guidelines define maintaining ongoing awareness of what?

• A. Information security, vulnerabilities, and threats
• B. Compliance budgets and expenditures
• C. Physical security controls
• D. Staff training effectiveness

Answer: (A)

Ongoing awareness of the information security posture, including current vulnerabilities and active threats, is what Information Security Continuous Monitoring is all about. SP 800-137 defines ISCM as a program that continuously monitors the security state of information systems, collecting data on how well security controls are functioning, what vulnerabilities exist, and what threats are present. This enables risk-based decisions and timely actions to maintain or improve security, rather than relying on periodic checks alone.

Budgets and expenditures are financial concerns, not the continuous picture of security health. Physical security controls focus on safeguarding facilities, not cyber threats and vulnerabilities. Staff training effectiveness matters for overall security culture, but ISCM centers on the real-time security state and threat landscape to guide responses and control adjustments.