Skip to main content
U.S. flag

An official website of the United States government

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

ISCMA: An Information Security Continuous Monitoring Program Assessment -- Draft NISTIR 8212 Available for Comment

Draft NISTIR 8212, "ISCMA: An Information Security Continuous Monitoring Program Assessment," is available for public comment through November 13, 2020.

Draft NIST Interagency Report (NISTIR) 8212ISCMA: An Information Security Continuous Monitoring Program Assessment, provides an operational approach to the assessment of an organization's information security continuous monitoring (ISCM) program.  The ISCM assessment (ISCMA) approach is consistent with the ISCM Program Assessment, as described in NIST SP 800-137A, Assessing ISCM Programs: Developing an ISCM Program Assessment.  The ISCMA process proceeds according to the following five steps:

  1. Plan the approach
  2. Evaluate the elements
  3. Score the judgments
  4. Analyze the results
  5. Formulate actions

Included with the ISCMA approach in this report is ISCMAx, a free, publicly-available working implementation of ISCMA that can be tailored to fit the needs of the implementing organization. ISCMAx produces a detailed scorecard with associated graphical output and identifies conditions that may warrant further analysis. The ISCMAx tool is a Microsoft Excel application and can be used in the Windows operating system; it does not run on the Macintosh operating system. NISTIR 8212 provides complete instructions for both using ISCMAx as provided, and for tailoring ISCMAx, if desired.
 
A public comment period for this document is open through November 13, 2020.  See the publication details for a copy of the draft publication, ISCMAx tool (Recommended Judgment and Alternate Judgment, macro-enabled spreadsheet), and instructions for submitting comments—preferably using the comment template provided.  For any questions, please contact sec-cert@nist.gov

NOTE: A call for patent claims is included on page vi of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Released October 1, 2020