Step 6: Monitor
Monitor keeps the authorization true after it is signed: it watches for changes, reassesses controls on a schedule, keeps the package current and tells the AO when risk moves. Done well, it replaces the three-year reauthorization scramble with ongoing authorization. Source: SP 800-37 Rev. 2, section 3.7; SP 800-137.
| Task | What it means in practice | Primary role | Output |
|---|---|---|---|
| M-1 System and environment changes | Track changes to the system, its environment and threats; analyze security and privacy impact | System owner, CCP | Change records, impact analyses |
| M-2 Ongoing assessments | Assess controls at the frequency in the ConMon strategy | Control assessor | Updated assessment results |
| M-3 Ongoing risk response | Act on new findings: remediate, mitigate or seek acceptance | System owner, CCP | Updated POA&M, remediations |
| M-4 Authorization updates | Keep the SSP, SAR and POA&M current | System owner, CCP | Current authorization package |
| M-5 Security and privacy reporting | Report posture to the AO and agency officials on the agreed schedule | System owner, CCP | Status reports |
| M-6 Ongoing authorization | AO reviews current risk and confirms the authorization still holds | AO | Confirmed, changed or withdrawn authorization |
| M-7 System disposal | Retire the system securely | System owner | Disposal records |
Handling change
Section titled “Handling change”Every change gets a security impact analysis before it is made (CM-4). Most changes are routine and flow through configuration management; a significant change sends the affected parts back through the RMF.
The impact analysis, not the size of the change, decides the path: a one-line change that adds a new external connection is significant, while a large routine patch cycle is not.
| Usually significant | Usually routine |
|---|---|
| New or changed interconnection or external service | Vendor patches within the approved baseline |
| New information types, new PII or a change in categorization | Adding or removing user accounts |
| Moving hosting (for example, on-premises to cloud) | Configuration changes within documented settings |
| New operating system, platform or major architecture change | Replacing hardware with the same approved model |
| Changes to cryptography or identity services | Minor software version updates with no new functions |
| A threat or vulnerability that changes the risk picture | Scaling capacity within the same design |
Your configuration management plan and the ATO terms define significant change for your system; when in doubt, ask the AODR.
Ongoing assessment cadence
Section titled “Ongoing assessment cadence”Frequencies come from the system ConMon strategy (task S-5). The values below are typical, not required.
| Activity | Typical frequency | Controls |
|---|---|---|
| Authenticated vulnerability scans of all components | Weekly to monthly | RA-5 |
| Configuration compliance scans (STIG or benchmark) | Monthly | CM-6 |
| POA&M review and update | Monthly | CA-5 |
| Audit log review | Daily to weekly | AU-6 |
| Privileged and user access review | Quarterly | AC-2 |
| Assess a rotating subset of controls | Annually (about one third of controls per year) | CA-2, CA-7 |
| Contingency plan test and incident response exercise | Annually | CP-4, IR-3 |
| Penetration test (where required) | Annually | CA-8 |
| Policy and procedure review | Annually | The -1 control in each family |
| SSP and inventory review | Annually and on significant change | PL-2, CM-8 |
How to apply it
Section titled “How to apply it”Automate what changes fast. Feed scanners, asset inventory and configuration data into dashboards; federal civilian agencies use CISA’s Continuous Diagnostics and Mitigation (CDM) program. Manual checks are for slow-changing controls.
Move to ongoing authorization deliberately. Under OMB Circular A-130, an AO can keep an authorization open-ended once continuous monitoring gives timely, reliable risk data. Agree the triggers with the AO in writing: time-based (monthly status report) and event-based (a significant change, a major incident, a high-risk finding past due).
Keep the package living. Update the SSP when the system changes, not at reauthorization. A package that is a year stale is a finding in itself.
Plan disposal early (task M-7). Retirement means sanitizing media under SP 800-88 Rev. 2 (September 2025), keeping records per the NARA schedule, closing interconnection agreements, updating systems that inherited controls from this one, retiring the PIA and SORN, removing the system from inventory and notifying the AO.
Done when (every reporting cycle)
Section titled “Done when (every reporting cycle)”Common findings
Section titled “Common findings”- Significant changes made without impact analysis or AO notice.
- POA&M dates moved repeatedly with no milestone progress.
- Scans cover only part of the inventory.
- ATO expired because nobody tracked the termination date.
- Decommissioned systems still listed as active, or never sanitized.
Key references
Section titled “Key references”SP 800-37 Rev. 2 section 3.7, SP 800-137, SP 800-137A, SP 800-128, SP 800-88 Rev. 2, OMB Circular A-130.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.