As a security compliance professional, your daily work leads to one goal: passing a C3PAO assessment and maintaining a CMMC-compliant status. This of course is much easier said than done. So, throughout this process, it’s difficult to account for every nuance in publications—especially as they come out.
In today’s regulatory compliance landscape, many organizations experience what’s known as “gap assessment fatigue.” This frustration stems from the repetitive and time-consuming task of manually collecting evidence (e.g., screenshots) to identify and assess compliance gaps. Often times, this resembles an endless game of whac-a-mole.
In the current state of security compliance, it’s critical to be secure and compliant at all times. No longer is it acceptable to simply be compliant on the day of an assessment, but rather, executives are expected to maintain a comprehensive security compliance program. That’s where Continuous Controls Monitoring comes in.
Continuous Controls Monitoring (CCM) refers to the use of automated tools and processes to monitor and assess the effectiveness of a company’s controls on a continuous basis.
This is a valid question. The short answer is, CCM can drastically reduce security compliance risks as well as costs of achieving compliance, developing a cyber risk program, and maintaining your compliance program.
The long answer is to consider how your organization prepares for a cybersecurity assessment, how many resources are spent chasing down technical configurations from security asset owners, and how documenting control readiness and evidence is managed. Meanwhile, when the independent assessor arrives, the fears (often unnecessary) of control gaps come:
Traditionally, to prepare for an assessment, compliance professionals have heavily relied on tools like Excel and Word for managing data collection and reporting processes, while painstakingly requesting screenshots and documentation from subject matter experts across the organization.
These methods not only consume a considerable amount of time and effort but are also prone to human error resulting in risks going unaddressed. CCM reduces compliance risk by enabling security controls and control owners, allowing for a more streamlined procedure for monitoring and assessing their effectiveness continuously.
Continuous Controls Monitoring with ASCERA leverages system data through existing security technology investments. This maximizes the effectiveness of your organization’s solutions, such as firewalls, intrusion detection systems, and security information and event management (SIEM) platforms by integrating and analyzing data across these systems.
This data is considered actual state i.e., the actual state of your system in the form of logs and machine-readable data.
This data feeds into the ASCERA compliance rules engine consisting of regulatory requirements, organization-specific policies, and tailored security control frameworks making up your desired state. The rules engine, in real-time, determines if your environment is meeting the desired state by comparing the system data of your actual state.
As a result, ASCERA CCM provides you real-time insight into the status of your control effectiveness and alerts your team if your controls are drifting out of compliance. This approach shifts your compliance program into a proactive state, rather than reacting to inconsistent point-in-time assessments.
Control: NIST 800-53: AU-11 Audit Record Retention, NIST 800-171: 3.3.1[e] [f] System Auditing
Using the CCM methodology, ASCERA compares your logging retention policy (desired state) against existing log records of all log sources and assets in your environment (actual state). As a result, this practice objectively determines if all log sources and assets meet the required retention period to support an investigation of incidents.
If any log sources or assets in your environment do not meet the log retention requirements, your team will be notified and be able to drill down into the compliance gap to facilitate remediation.
Your proactive security compliance program will know in real-time if log retention requirements have not been met, and more importantly, your team will have visibility before going into an assessment that all assets are meeting requirements.
With CCM becoming a requirement of the most common security compliance frameworks, understanding the basics is essential. If your organization is seeking compliance certification or needs to maintainits current status, solutions that automate CCM can bolster assurance and convenience. ASCERA is a tool that applies the CCM methodologyto bridge the gap between your organization’s actual state and desired state. To learn if it’s a good option for your organization’s CCM needs, chat with one of our solutions advisors today!
