cATO – The New Frontier: Continuous Monitoring (CONMON) (Part 4 of 5)

cATO – The New Frontier: Continuous Monitoring (CONMON) (Part 4 of 5)

Recap: SSSC, ACD, and the Path to CONMON

In Part 1, we traced the origins of Continuous Authorization to Operate (cATO), from the bottlenecks of the traditional ATO process to the OSD memo that established cATO as an evolution of the Risk Management Framework, anchored by three core pillars: Secure Software Supply Chain (SSSC), Active Cyber Defense (ACD), and Continuous Monitoring (CONMON). Part 2 examined SSSC, detailing how the evaluation criteria assess an organization’s DevSecOps Platform, processes, and people to ensure software entering the pipeline is trustworthy from the start. Part 3 then turned to ACD, covering the CSSP engagement, penetration testing, and incident-response capabilities required to detect and respond to threats in real time. In this installment, we close out the three pillars with CONMON, the competency that ties ongoing visibility and risk reporting together that enables Authorizing Officials to make real-time, risk-informed decisions throughout a system’s lifecycle.

Establishing the Risk Management and CONMON Strategy

CONMON centers on maintaining a documented, risk-based strategy for continuously assessing the security posture of a system rather than the reliance upon a one-time authorization. This begins with the documentation of a Risk Management Strategy that sets risk tolerances that are aligned with the system’s risk posture and includes processes for tracking both insider and external threats. Secondly, an organization must also produce a System CONMON Strategy that defines an ongoing plan to assess and track vulnerabilities across every system asset as well as establish impact and efficacy metrics to identify patterns and threats. These metrics combined with defined monitoring cadences, whether they are automated checks run at predefined intervals or manual reviews done annually, facilitate tight integration with the organization’s auditing and incident-response strategies.

Supporting Documentation and Real-Time Access to Risk Data

Supporting this strategy requires specific documentation, most notably a System Authorization Boundary Diagram depicting data flows and external connections consistent with the DISA Connection Process Guide. Organizations must also establish clear business rules assigning defined cybersecurity roles and responsibilities, identifying subject matter experts to sustain the system’s risk posture, and establishing a vulnerability coordination point of contact. Critically, the AO and designated cybersecurity personnel must have real-time access to testing, scanning, and monitoring results in a mutually agreeable format, typically dashboards and automated alerts, so that risk information can be identified, prioritized, and shared as it emerges rather than after the fact.

Operationalizing Monitoring: Dashboards, CMRS, and Pipeline Assessments

The second half of CONMON requirements focuses on the operationalization and auditability of the ongoing monitoring environment. Organizations must demonstrate automated monitoring capabilities through a near-real-time dashboard that security personnel and the Authorizing Official (AO) actively use. The monitoring implementation must also feed compliance statistics into the Continuous Monitoring & Risk Scoring (CMRS) system of record through automation where possible and include alerts that notify personnel when thresholds are breached. This monitoring should extend to the software development pipeline itself and not just the deployed application. Underlying security assessments must also cover the DevSecOps Platform’s (DSOP) full lifecycle including threat modeling, penetration testing, attack-surface reviews, manual code reviews, software composition analysis (SCA), Static Application Testing (SAST), Dynamic Application Testing (DAST), Interactive Application Testing (IAST).

Maintaining a Living System Authorization Package

Finally, CONMON requires organizations to maintain a complete and current System Authorization Package including the Security Assessment Plan, Security Assessment Report, Risk Assessment Report, System Security Plan, the signed ATO memo, and Plans of Action and Milestones (POA&Ms) with all of these documents updated in response to the ongoing monitoring process rather than treated as static artifacts as in a traditional ATO.

Coming Up in This Series

Having examined the DevSecOps Platform, Process, and People requirements of SSSC, the detection and response capabilities of ACD, and the risk visibility requirements of CONMON, we’ve now covered the full evaluation criteria individually. Part 5 closes out the series by looking at the practical realities of implementation and what the path to a sustained cATO looks like for an organization just starting the journey.

 

Here at Andrew Morgan we help organizations obtain the highest value from their human capital, organizational, and technical investments to lower costs and optimize how they work, with capabilities spanning business process improvement, systems engineering and integration, analytics and reporting, infrastructure modernization, regulatory risk/compliance, and security and information assurance. If you are looking for a partner to help navigate your organization or program through this new way of working, we would love to hear from and engage with you directly.