What it covers. NIST guidance on establishing a continuous monitoring programme that maintains ongoing awareness of security posture, vulnerabilities and threats to support risk decisions. It covers defining a strategy, establishing the programme, implementing it, analysing and reporting findings, responding and reviewing the programme.
In practice. Organisations decide which controls and metrics to monitor, at what frequency, and who receives the results, combining automated data such as configuration and vulnerability status with manual assessments. Results feed risk decisions and authorisation, not only dashboards. Evidence includes the monitoring strategy, defined metrics and frequencies, reports to decision makers and actions taken on findings.
Common gaps. Common gaps are collecting large amounts of data without defined decisions it should inform, and monitoring frequencies that do not match the risk of the system.