Module 7 Continuous Monitoring, Change, and POA&M
What you will be able to do
- Build a system-level continuous monitoring strategy with frequencies and thresholds.
- Write, run, and close Plan of Action and Milestones entries.
- Perform a security impact analysis and decide whether a change is significant.
- Apply the current federal vulnerability remediation and logging requirements, and check them at the source.
- Read monitoring measures critically, report posture, and escalate at the right time.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. The Monitoring Strategy · 40 min Completed
- 2. Writing and Running the POA&M · 50 min Completed
- 3. Change and Security Impact Analysis · 45 min Completed
- 4. Vulnerability Remediation and Logging Requirements Today · 45 min Completed
- 5. Reading the Dashboard and Escalating · 35 min Completed
Practice and quiz
- Practical exercise: POA&M Entries, a Security Impact Analysis, and a Monthly Summary for TreasuryFlow
- Module quiz (10 questions, pass mark 80 percent)
Templates and files
Overview
The authorization is signed. This module covers everything after: the Monitor step of the Risk Management Framework (RMF), which lasts for the rest of the system's life. It is the step where an Information System Security Officer (ISSO) spends most of the year.
Five skills make up the work: planning what to watch, running the Plan of Action and Milestones (POA&M), analyzing change, meeting the dated federal requirements for vulnerabilities and logging, and turning numbers into reports and timely escalation.
Builds on
- Module 6, Lesson 5 and exercise: the conditions attached to TreasuryFlow's authorization, which you now have to track.
- Module 5, Lesson 4: findings, which become POA&M entries.
- Module 4, Lesson 5: keeping the security plan true.
- Module 1, Lesson 2: binding authority and guidance. Lesson 4 here depends on that distinction.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | The Monitoring Strategy | 40 min | Adapted from existing material |
| 2 | Writing and Running the POA&M | 50 min | New |
| 3 | Change and Security Impact Analysis | 45 min | Adapted |
| 4 | Vulnerability Remediation and Logging Requirements Today | 45 min | Adapted; time-sensitive |
| 5 | Reading the Dashboard and Escalating | 35 min | New |
Resources
- POA&M tracker and dashboard (
poam-tracker.xlsx). A working spreadsheet with TreasuryFlow's five weaknesses as examples, automatic age and overdue calculations, and a summary sheet. New. - Monitoring strategy template (
iscm-strategy-template.md). New.
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| FISMA | Binding statute | Requires periodic testing and a process for remedial action |
| OMB Circular A-130 | Binding policy | Requires ongoing monitoring and permits ongoing authorization |
| CISA BOD 26-04 (June 2026) | Binding on federal civilian executive branch agencies | Issued under CISA's statutory directive authority; sets remediation timelines |
| OMB M-26-14 (May 2026) | Binding policy on agencies | OMB direction on logging; rescinds M-21-31 |
| CISA Known Exploited Vulnerabilities catalog | Reference made binding by directive | A list; the directive gives it force |
| NIST SP 800-137, 800-137A | Guidance | Method for continuous monitoring |
| NIST SP 800-128, 800-40 | Guidance | Configuration and patch management methods |
| NIST SP 800-53 controls CA-5, CA-7, CM-3, CM-4, RA-5, SI-2, AU family | Guidance, required in practice | Selected in baselines applied through Circular A-130 and FIPS 200 |
| NIST SP 800-55 | Guidance | Measurement method |
| SSVC | Guidance / method | A decision method the directive draws on |
| Agency vulnerability, POA&M, change, logging, and incident policies | Binding within the agency | These set the deadlines and formats you actually work to |
| "Every control at least once in three years" | Agency policy where used | Not a universal federal rule |
| Authorization conditions | Binding on the system | The authorizing official's direction |
Module summary
- Monitoring keeps the authorization true. "Continuous" means at a frequency that fits the risk.
- A strategy says what is watched, how, how often, by whom, the threshold for action, and where results go. Inherited services are included.
- A POA&M entry states the condition, an owner, observable milestones, and a scheduled completion date that is never overwritten. It closes on verified evidence.
- Only the authorizing official accepts risk. Inherited weaknesses are tracked, not closed locally.
- Every change gets a security impact analysis before it is made. Significant changes go to the authorizing official; significant does not automatically mean reauthorization.
- Vulnerability deadlines for federal civilian agencies now come from four questions about exposure, known exploitation, automatability, and technical impact. Logging policy is now risk-based under a 2026 memorandum. Both are recent: confirm details at the source.
- When a binding requirement changes, compare, record, and update through the proper process.
- Read every number for its denominator and trend. Escalate early, in writing, with facts, judgment, and a request.
What comes next
Module 8 looks outward: cloud services, the federal cloud authorization program, vendors, and connections to other systems. It starts from the change you analyze in this module's exercise.
Last reviewed 2026-11-12. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.