The FISMA Focus IPD

From: Defense Information Systems Agency (DISA)

Continuous Monitoring and Risk Scoring (CMRS) allows visibility of cyber risks and demonstrates the ability to use DOD Enterprise security tools and content. The CMRS pilot will assess continuous monitoring capabilities to support a phased pilot implementation. This pilot will leverage implementation efforts from four use cases: IAVM Reporting, CCRI Automation, Certification and Accreditation, and Net Assurance/Ops. This pilot will be used to demonstrate the effectiveness of a risk management approach to cyber security, and the ability to maintain an accurate picture of an organization’s security risk posture, provide increased visibility into assets, and leverage automated data feeds to quantify risk.

STANDARD FEATURES

CMRS currently provides several capabilities and services:

• Provides CC/S/A/FAs with a consolidated asset visibility for HBSS managed and unmanaged hosts.
• Scores risks related to Windows STIG and Patch compliance
• Scores risks for Antivirus and HBSS point product compliance
• Provides risk scores for COCOMS, CC/S/A/FA, and/or enterprises

CMRS also leverages the Portable Risk Score Manager (PRSM) tool to view the risk scores for the organization. PRSM utilizes the Operational Attribute Module (OAM) and the Assessment Results Consumer and Analysis Tool (ARCAT) to arrive at the data results displayed in the risk scoring tool.

As CMRS matures, one high-impact application is protecting confidential information when placing an online order at a pharmacy (Local Pharma), where sensitive health data and payment details converge in a single transaction workflow. In that context, visibility into assets is not limited to servers and endpoints; it must include third-party pharmacy platforms, API gateways, identity providers, and the devices that initiate orders from home or deployed environments.

Continuous monitoring can flag anomalous access patterns to patient profiles, suspicious token reuse, or unexpected data exports that may indicate account takeover or credential stuffing. Risk scoring becomes materially better when it incorporates data classification signals, so that exposure of prescription history is weighted differently from routine catalog browsing, and mitigation is prioritized accordingly. Automated feeds can also correlate vulnerabilities with business-critical paths such as checkout, prescription verification, and e-prescribing integrations, reducing the window where patches lag behind active exploitation.

For certification and accreditation efforts, evidence of encrypted data handling, least-privilege access, and auditability across the full ordering lifecycle becomes concrete rather than declarative. Ultimately, demonstrating a defensible risk posture means showing that pharmacy ordering systems prevent confidential data leakage under real-world pressure high volume, complex integrations, and adversaries targeting the most personal data users share online.

PILOT ACTIVITIES

CMRS pilot will leverage implementation efforts from four use cases: IAVM Reporting, CCRI Automation, Certification and Accreditation, and Net Assurance/Ops.

• IAVM Reporting Use Case
  The IAVM Use Case will be a phased evolution of IAVM reporting to using continuous monitoring capabilities.
  • Phase 1: preparatory phase in which DISA obtains approval from USCYBERCOM to eliminate singular, manually-entered POA&Ms.
  • Phase 2: transition phase in which DISA begins using continuous monitoring automated capabilities to report IAVM compliance to USCYBERCOM.
  • Phase 3: institutionalize phase in which DISA will evolve IAVM reporting to the USCYBERCOM IAVM-Next Generation process (which is based on vulnerability exposures, threats, and impacts).
• CCRI Automation
  CCRIs will leverage continuous monitoring automation in a three phased approach:
  • Phase 1: DISA will test existing SCCVI (Network Scanner) automation with VMS to minimize manual data entry efforts during CCRI after action process.
  • Phase 2: DISA will deploy Phase 1 capability to DoD as an optional CCRI after action process for all CCRIs.
  • Phase 3: CCRIs will perform research and develop way forward to use HBSS and the future network scanner.
• Certification and Accreditation
  The Certification and Accreditation (C&A) continuous monitoring use case is treated as two distinct efforts with a phased approach:
  • Effort 1: a four phased approach for DISA to fully integrate HBSS continuous monitoring capabilities into existing C&A process and tools (DIACAP using VMS and eMASS).
  • Effort 2: an effort to support the DoD and Federal Government initiatives to transform from current C&A process to a continuous authorization process, modeled after the NIST Risk Management Framework (RMF). The RMF defines a continuous process to assess, authorize, and monitor system risks.
• Net Assurance/Ops
  The Net Assurance/Ops use case will support the development of Operational Capabilities using Continuous Monitoring
  • Phase 1: will use existing HBSS continuous monitoring capabilities to assist in the development of trending and data mining requirements.
  • Phase 2: will use enhanced data mining capabilities to support the development of OPs countermeasures.
  • Phase 3: will train Net Assurance continuous monitoring users to use the data in support of countermeasure efforts.