Skip to main content
Sanvada

RMF Monitor step

RMF continuous monitoring assessments

Scheduled assessments of the controls your continuous monitoring strategy calls for each period, so an authorization stays current.

Typical duration

Recurring, usually quarterly or annual, as your monitoring strategy sets

Request a quote

Fixed fee, reply within two business days.

Why assessment continues after authorization

An authorization is a decision about risk at a point in time. Systems change, threats change, and controls drift. The monitor step of the Risk Management Framework keeps the authorizing official’s picture current: controls are reassessed on a schedule, and findings flow into the plan of action and milestones and the authorization decision.

How it works

At the start of each period we agree with the system owner which controls are due, based on the continuous monitoring strategy and any significant changes since the last assessment. We assess them with the same NIST SP 800-53A procedures used for the initial assessment, then report the results so the security assessment report and the plan of action and milestones stay current.

Planning the calendar

Most organizations run continuous monitoring assessments quarterly or annually. A fixed calendar agreed at the start of the authorization period lets your team plan evidence collection and keeps the authorizing official’s reporting on time.

Questions

Common questions about rmf continuous monitoring assessments

How many controls are assessed each period?
As many as your continuous monitoring strategy calls for. NIST SP 800-137 leaves the frequency to the organization, based on how volatile each control is and how critical the system is. Volatile controls are usually assessed more often, and the full baseline is covered across the authorization period.
Do you reassess after a significant change?
Yes. The system owner decides which controls the change affects, through a security impact analysis, and we assess those controls before or soon after the change, as the authorizing official requires.
Does this need to be the same assessor as the initial assessment?
No. Agencies often prefer continuity because it shortens the ramp-up, but continuous monitoring assessments can be performed by any qualified, independent assessor working from the existing system security plan and assessment report.

Related services

Related services

RMF Assess step

NIST SP 800-53 control assessments

Independent assessment of your NIST SP 800-53 controls for the Assess step of the Risk Management Framework, reported in a security assessment report.

Learn more
Contractors handling CUI

NIST SP 800-171 assessments

Independent assessment of the NIST SP 800-171 security requirements for contractors and suppliers that handle controlled unclassified information.

Learn more
Months 0 to 3

ISO 27001 certification

Initial certification of your ISMS against ISO/IEC 27001:2022: Stage 1, Stage 2, and an independent certification decision.

Learn more

Ready to scope your audit?

Tell us about your organization, your ISMS scope, and your target date. We reply with a fixed-fee quote and available audit dates within two business days.

Request a quoteSee how certification works