CGRC - Domain 7 - Continuous Monitoring & Ongoing Authorization

This podcast outlines the continuous monitoring phase of the Risk Management Framework (RMF), emphasizing the need for ongoing situational awareness in federal information systems. The provided text details how organizations must systematically track changes to technology, personnel, and operational environments to ensure that security and privacy controls remain effective over time. Key processes include performing security impact analyses, conducting regular audits, and utilizing automated tools like SCAP and SIEM for efficient data collection. The documentation also highlights the importance of reporting risk posture to authorizing officials to support near real-time authorization decisions. Finally, the guides address the end of the system life cycle, providing protocols for secure media sanitization and the formal decommissioning of information systems.