Which SP 800 document covers Information Security Continuous Monitoring for Federal Information System and Org?

• A. Information Security Continuous Monitoring for Federal Information System and Org
• B. Technical Guide to Information Security Testing and Assessment
• C. Guide to Computer Security log Management
• D. Guideline for Media Santitization

Answer: (A)

Continuous monitoring is an ongoing process of collecting, analyzing, and acting on security information to maintain an up-to-date view of an information system’s risk posture. NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, provides the guidance and framework for how federal agencies implement this program across systems and the broader organization. It covers establishing the continuous monitoring program, defining roles and responsibilities, identifying the data and metrics needed, setting baselines, and using the collected information to make timely risk-based decisions. The other documents focus on different areas—testing and assessment, log management, and media sanitization—rather than the ongoing monitoring of security controls.