topic Re: Continuous Monitoring Plan (RMF) in Governance, Risk, Compliance

Continuous Monitoring Plan (RMF)

BIRISH — Mon, 09 Oct 2023 09:48:13 GMT

I am looking for a good example of a Continuous Monitoring Policy/Plan/SOP (or all of the above) for use within the DoD RMF world. Anyone?

Re: Continuous Monitoring Plan (RMF)

tmekelburg1 — Wed, 17 Feb 2021 18:16:29 GMT

Here is one where they combine the policy and the NIST standards into one document. Personally, I'd make two separate documents but this is a start. Also, check out NIST SP 800-137 and 137A for more info on the subject.

https://files.nc.gov/ncdit/documents/Statewide_Policies/SCIO_Security_Assessment_Authorization.pdf

Re: Continuous Monitoring Plan (RMF)

AppDefects — Thu, 18 Feb 2021 02:44:16 GMT

From a technical perspective I suggest thinking about the solution architecture and then adding the security monitoring components. I like storyboarding those kinds of solutions, they are more practical than paper policy.

Re: Continuous Monitoring Plan (RMF)

RRoach — Wed, 03 Mar 2021 13:34:54 GMT

Each agency (there is roughly 100 command/service/agencies) has their own interpretation of continuous monitoring. Start with looking at the specific agencies document structure (font/headings/etc.) to develop a template then tailor it. You also might be able to get some insight from DoD policies as well.

Re: Continuous Monitoring Plan (RMF)

JaceSin — Thu, 18 May 2023 22:38:48 GMT

I am also looking for Continuous Monitoring Strategy & Continuous Monitoring Plan templates to satisfy the RMF controls. Anyone know where to find good templates please let us know. Thank you.

Re: Continuous Monitoring Plan (RMF)

RMF_Expert — Fri, 03 Nov 2023 17:32:45 GMT

The team I'm on at HQDA G6 is working the ConMon strategy with other components. We will likely follow NIST SP 800-137 as a base but align with Sentinel's Army RMF 2.0 strategy and the Army Unified Network Plan. I will share any useful docs once we put them together and get the go ahead to distribute them. In the mean time I can recommend the FedRAMP continuous monitoring documents that also follow NIST 800-137.

Re: Continuous Monitoring Plan (RMF)

clane — Tue, 15 Apr 2025 11:06:48 GMT

do you happen to have any work breakdown structure for continuous monitoring?

Re: Continuous Monitoring Plan (RMF)

akkem — Tue, 15 Apr 2025 21:51:08 GMT

You can Start with templates aligned to NIST SP 800-137, 800-37, and 800-53.

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls
NIST SP 800-137 provide comprehensive guidance on establishing and assessing Information Security Continuous Monitoring (ISCM) programs.
NIST SP 800-37 outlines the RMF process, including the development and implementation of a continuous monitoring strategy at the organizational level.