System owners monitor each system, and associated cyber threats, security risks and controls, on an ongoing basis.
Topic
Protecting systems and their resources
Applicable to
all
History
Priority
Must
Jun 2022
System owners monitor each system, and associated cyber threats, security risks and controls, on an ongoing basis.
Miscellaneous changes were made to rationale and recommendations throughout the publication to clarify content. This included the adoption of ‘control’ terminology, in preference to ‘security control’ terminology, to allow for the capture of other types of controls in the future, such as privacy controls, in addition to security controls.
In addition, formatting changes were made to the system security plan annex template and the cloud controls matrix template in order to increase their alignment, such as the inclusion of an ‘implementation status’ column within the system security plan annex template. Furthermore, a new ‘responsible entity’ column was added to both templates in order to capture information on the responsible system (in the case of inherited controls) or responsible vendor (in the case of multi-vendor systems) that are responsible for the implementation of controls. Note, this column can also be used to capture information on teams or individuals that are responsible for the implementation of controls if desired.
Jan 2021
System owners monitor each system, and associated cyber threats, security risks and security controls, on an ongoing basis.
Security control 1526 was moved from under the ‘monitoring cyber threats, security risks and security controls’ topic heading to under the ‘protecting systems and their resources’ topic heading and modified to align more closely with the wording of the associated step within the six step risk management framework.
Dec 2020
System owners monitor security risks and the effectiveness of security controls for each system.
Nov 2018
System owners monitor security risks and the effectiveness of security controls for each system.
Added to address a gap in guidance on system owners monitoring security risks and the effectiveness of security controls throughout the lifetime of their systems.