PM-31 Continuous Monitoring Strategy

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: AC-2, AC-6, AC-17, AT-4, AU-6, AU-13, CA-2, CA-5, CA-6, CA-7, CM-3, CM-4, CM-6, CM-11, IA-5, IR-5, MA-2, MA-3, MA-4, PE-3, PE-6, PE-14, PE-16, PE-20, PL-2, PM-4, PM-6, PM-9, PM-10, PM-12, PM-14, PM-23, PM-28, PS-7, PT-7, RA-3, RA-5, RA-7, SA-9, SA-11, SC-5, SC-7, SC-18, SC-38, SC-43, SI-3, SI-4, SI-12, SR-2, SR-4

Control statement

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:

• a. Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics];
• b. Establishing [Assignment: organization-defined monitoring frequencies] and [Assignment: organization-defined assessment frequencies] for control effectiveness;
• c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;
• d. Correlation and analysis of information generated by control assessments and monitoring;
• e. Response actions to address results of the analysis of control assessment and monitoring information; and
• f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

NIST discussion

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms “continuous” and “ongoing” imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, AC-2g, AC-2(7), AC-2(12)(a), AC-2(7)(b), AC-2(7)(c), AC-17(1), AT-4a, AU-13, AU-13(1), AU-13(2), CA-7, CM-3f, CM-6d, CM-11c, IR-5, MA-2b, MA-3a, MA-4a, PE-3d, PE-6, PE-14b, PE-16, PE-20, PM-6, PM-23, PS-7e, SA-9c, SC-5(3)(b), SC-7a, SC-7(24)(b), SC-18b, SC-43b, SI-4.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-31

Determine if an organization-wide continuous monitoring strategy is developed;

• PM-31a. continuous monitoring programs are implemented that include establishing [Assignment: organization-defined metrics] to be monitored;
• PM-31b.
  • PM-31b.[01] continuous monitoring programs are implemented that establish [Assignment: organization-defined monitoring frequencies] for monitoring;
  • PM-31b.[02] continuous monitoring programs are implemented that establish [Assignment: organization-defined assessment frequencies] for assessment of control effectiveness;
• PM-31c. continuous monitoring programs are implemented that include monitoring [Assignment: organization-defined metrics] on an ongoing basis in accordance with the continuous monitoring strategy;
• PM-31d.
  • PM-31d.[01] continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
  • PM-31d.[02] continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
• PM-31e.
  • PM-31e.[01] continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
  • PM-31e.[02] continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
• PM-31f.
  • PM-31f.[01] continuous monitoring programs are implemented that include reporting the security status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency];
  • PM-31f.[02] continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

Examine: Information security program plan; privacy program plan; supply chain risk management plan; continuous monitoring strategy; risk management strategy; information security continuous monitoring program documentation, reporting, metrics, and artifacts; information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts; assessment and authorization policy; procedures addressing the continuous monitoring of controls; privacy program continuous monitoring documentation, reporting, metrics, and artifacts; continuous monitoring program records, security, and privacy impact analyses; status reports; risk response documentation; other relevant documents or records..

Interview: Senior Accountable Official for Risk Management; chief information officer; senior agency information security officer; senior agency official for privacy; organizational personnel with information security, privacy, and supply chain risk management program responsibilities.

Test: Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring.

Policy statement

• The Chief Information Security Officer shall develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that follow it. (PM-31)
• The programs shall monitor these organization-wide metrics: Fill in: the metrics for organization-wide continuous monitoring Typical: systems with a current authorization, plan of action items past due, vulnerabilities remediated within the required times, and staff with current security awareness training. (PM-31a)
• The programs shall monitor control effectiveness Fill in: the frequencies for monitoring Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data. (PM-31b)
• The programs shall assess control effectiveness Fill in: the frequencies for assessing control effectiveness Typical: a third of each system’s controls each year, so every control is assessed at least every three years. (PM-31b)
• The programs shall monitor the organization-wide metrics on an ongoing basis, as the strategy sets out. (PM-31c)
• The programs shall correlate and analyze the information that control assessments and monitoring produce. (PM-31d)
• The programs shall take response actions to address the results of that analysis. (PM-31e)
• The Chief Information Security Officer shall report the security status of organizational systems to Fill in: the personnel or roles for reporting the security status of organizational systems to Typical: the senior leader and the authorizing officials Fill in: the frequency at which to report the security status of organizational systems Typical: monthly. (PM-31f)
• The Senior privacy official shall report the privacy status of organizational systems to Fill in: the personnel or roles for reporting the privacy status of organizational systems to Typical: the senior leader and the authorizing officials Fill in: the frequency at which to report the privacy status of organizational systems Typical: quarterly. (PM-31f)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-31 asks for an organization-wide continuous monitoring strategy, and continuous monitoring programs that follow it. The programs set organization-wide metrics (a) and frequencies for monitoring and for assessing control effectiveness (b). They monitor the metrics on an ongoing basis (c), correlate and analyze what assessments and monitoring produce (d), act on the results (e), and report the security and privacy status of systems to set roles at a set frequency (f). PM-31 is in the SP 800-53B Privacy baseline.

NIST’s PM-31 discussion says organization-level monitoring gives ongoing awareness of the security and privacy posture to support risk decisions. “Continuous” and “ongoing” mean often enough to support risk-based decisions, and different controls may need different frequencies. Monitoring lets organizations keep authorizations of systems and common controls current, including ongoing authorization, and the metrics should align with the risk tolerance in the risk management strategy (PM-9). Each system’s monitoring (CA-7) works within it.

SP 800-37 Rev. 2 task P-7 asks for the same strategy, with the senior accountable official for risk management or the risk executive (function) (PM-29) primarily responsible. The strategy sets the minimum monitoring frequency for implemented controls, the ongoing assessment approach, and may set reporting requirements and recipients. That official or function “approves the continuous monitoring strategy including the minimum frequency with which controls are to be monitored.” SP 800-137 (September 2011, current as of October 2026) describes the process: define the strategy, establish the program (section 3.2.1 on metrics, 3.2.2 on frequencies), implement it, analyze and report, respond, and review and update. The P-7 discussion says the strategy can include supply chain risk, such as regular reviews of suppliers (PM-30).

Common implementations. The Continuous Monitoring Strategy template holds both levels. Part A is the organization-wide strategy: the metrics, monitoring and assessment frequencies and reporting (section 3), the minimum frequencies every system meets (section 4), and the tools (section 5). Part B is each system’s strategy under CA-7. Sections 10 to 13 carry out analysis, reporting, response and review. The Program Management policy has the Chief Information Security Officer develop the strategy and report security status, and the senior privacy official report privacy status. Section 14 records the approval of Part A by the senior accountable official for risk management, as task P-7 describes, and by the senior privacy official for the privacy controls.

The strategy covers privacy controls too. The template lets one document serve as both the security and the privacy continuous monitoring strategy; if your organization keeps them apart, say in Part A where the privacy strategy is.

Correlation and analysis (d) is where many programs fall short. Look across systems for the same weakness, compare metrics against their thresholds and trends, and feed the results into common control changes and plans of action and milestones (PM-4, CA-5).

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Organization-wide metrics (a)	Systems with a current authorization, plan of action items past due, vulnerabilities remediated within the required times, and staff with current security awareness training
Monitoring frequencies (b)	Continuously for automated controls, and at least monthly for vulnerability, configuration and account data
Assessment frequencies (b)	A third of each system’s controls each year, so every control is assessed at least every three years
Roles that receive security status (f)	The senior leader and the authorizing officials
Roles that receive privacy status (f)	The senior leader and the authorizing officials
Security status reporting frequency (f)	Monthly
Privacy status reporting frequency (f)	Quarterly

The metrics match the performance measures in section 6 of the Information Security Program Plan, so one data set serves both. SP 800-137 section 3.2.1 gives similar examples, such as vulnerabilities found and remediated and employees current on awareness training.

Evidence assessors ask for.

• The approved strategy, with the approval of the senior accountable official for risk management or the risk executive (function)
• Definitions of each metric, with its calculation, data source and threshold (a)
• The monitoring and assessment schedules, and records that they were followed (b, c)
• Analysis outputs, such as dashboards and trend reports (d)
• Response records: plans of action and milestones, changed controls, changed frequencies (e)
• Security and privacy status reports, with dates and recipients (f)
• The record of the last review and update of the strategy

Inheritance. PM-31 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system’s continuous monitoring (CA-7) follows the organization-wide strategy and may tighten it but not loosen it.

Common findings.

• Metrics defined in the strategy but never collected.
• Frequencies set for automated controls only, with nothing for controls assessed by hand.
• Status reports that go to the Chief Information Security Officer and no further (f).
• No privacy status reporting, or privacy controls left out of the strategy.
• Findings from monitoring that never reach a plan of action and milestones (e).
• A strategy approved only by its author, with no senior official approving the frequencies.

Enhancements. PM-31 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 4.d(5) to (8), requires an information security continuous monitoring (ISCM) strategy and program, with metrics that show security status and trends at all risk management tiers. Section 4.d(9) and (10) require a privacy continuous monitoring (PCM) strategy that assigns an agency-defined assessment frequency to each privacy control, and a PCM program, and footnote 85 allows the two to be combined. Section 5.k says the strategies must document all controls selected and implemented, including the frequency and rigor of monitoring, and all common controls inherited by agency systems; they “must be approved by the appropriate agency authorizing official and SAOP, respectively.” OMB’s FY 2026 SAOP FISMA Reporting Metrics (August 2026) ask SAOPs to submit the privacy continuous monitoring strategy through CyberScope by October 30, 2026.

Artifacts

• Continuous Monitoring Strategy
• Program Management Decision Worksheet
• Program Management Policy
• Risk Management Strategy