nCircle Federal Outlook Blog

Advocates of expanding continuous monitoring of security controls got a great boost earlier this month with the appearance of the FY 2011 CIO FISMA Reporting Metrics. Especially interesting was the last section of the document, which asks agencies to report on their use of continuous monitoring in the areas of IDS/IPS; AV/Anti-Malware/Anti-Spyware; System Logs; Application Logs; Patch Status; Vulnerability Scans; DNS logging, and numerous other areas. This is very exciting, especially coupled with the emergence of Security Performance Management services like nCircle Benchmark, which could help agencies deliver on these requirements using the products and solutions they are already running.

However, all of the buzz on this document seems to trace back to the SANS NewsBites announcement and posting of the document on their website. After repeated searches, I can't find this report on the DHS website at all, or from any other government source. According to SANS, "The memo stems from 2010 guidance requiring government agencies to begin moving to continuous security monitoring." So, where exactly did this document come from? What does it mean? Inquiring minds -- and all those heavily invested in helping the government meet continuous monitoring requirements -- want to know...