CA-7(3)

Requirement

Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Discussion

Trend analyses include examining recent threat information that addresses the types of threat events that have occurred in the organization or the Federal Government, success rates of certain types of attacks, emerging vulnerabilities in technologies, evolving social engineering techniques, the effectiveness of configuration settings, results from multiple control assessments, and findings from Inspectors General or auditors.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Organizational continuous monitoring strategy; system-level continuous monitoring strategy; assessment, authorization, and monitoring policy; procedures addressing continuous monitoring of system controls; privacy controls; assessment report; plan of action and milestones; system monitoring records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with continuous monitoring responsibilities; organizational personnel with information security and privacy responsibilities].

ID	Assessment Objectives
CA-07(03)[01]	trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data;
CA-07(03)[02]	trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data;
CA-07(03)[03]	trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!