Key Facts
- Regulator
- National Institute of Standards and Technology (NIST), Information Technology Laboratory, Computer Security Division (US Department of Commerce)
- Latest version
- NIST SP 800-137 (Final), Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, published September 2011. NIST lists no later edition.
- Effective
- 30 September 2011
- Official text
- csrc.nist.gov ↗
What is NIST 800-137?
NIST 800-137, formally NIST SP 800-137, is guidance from the US National Institute of Standards and Technology on information security continuous monitoring (ISCM): maintaining ongoing awareness of security, vulnerabilities and threats to support risk decisions. It is written for US federal information systems and organisations, and other organisations may use it voluntarily.
The full title is Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. It is published by NIST's Information Technology Laboratory, Computer Security Division, part of the US Department of Commerce. The final version appeared in September 2011 (document history entry 30 September 2011), and NIST lists no later edition on its publication page.
NIST 800 137 continuous monitoring works in two stages: first an ISCM strategy, then an ISCM programme that puts it into operation. NIST's abstract states the outcome: ongoing assurance that security controls stay aligned with the organisation's risk tolerance, and the information needed to respond in time when they fall short.
A scan that nobody reads is a log, not monitoring.
Why it matters
The questionnaire asks how you monitor your controls between audits. You have an annual penetration test, a weekly scan, and no record of a decision either one changed. The answer feels thin because it is.
NIST 800-137 treats monitoring as an input to risk decisions, not a reporting chore. Data is collected so that someone can decide something: accept a risk, fix it, or change the strategy. ISCM also supports ongoing authorisation of federal systems, which is why the document carries weight in US federal work.
An annual assessment describes last year's system.
Who it applies to
NIST wrote SP 800-137 for people who design, develop, implement, operate, maintain and dispose of federal information systems, from agency heads to system owners and assessors. NIST scopes it to federal information systems and organisations. It does not apply to every organisation by default.
The obligation is guidance, not law. NIST issued it under its statutory responsibilities under FISMA. It does not apply to national security systems without the express approval of appropriate federal officials. For everyone else it is voluntary: NIST states that non-governmental organisations may use it on a voluntary basis. It is not a certifiable standard, so there is no certificate to hold and no accredited audit scheme.
NIST does not relate SP 800-137 to ISO/IEC 27001 in the document. The nearest ISO 27001 requirement is clause 9.1, which asks you to decide what to monitor and measure, and how to analyse the results. If you already run an ISMS, treat SP 800-137 as a detailed reference for that work, not a second certification. The ISO 27001 vault covers the management-system side.
The UK position
A UK firm rarely meets NIST SP 800-137 directly. NIST issued it for US federal agencies, and we have not sourced any UK regime that names it. Where it does appear, the likeliest route is a US customer citing it in a contract or security questionnaire, and then its force comes from that reference.
Key requirements
SP 800-137 describes a process, not a control list. NIST sets out six steps to establish, implement and maintain ISCM:
- Define the ISCM strategy. Decide what is monitored and why, driven by organisational risk.
- Establish the ISCM programme. Turn the strategy into a defined programme.
- Implement the ISCM programme. Put the monitoring into operation.
- Analyse the data and report findings. Turn collected data into something a decision-maker can use.
- Respond to findings. Act on what the analysis shows.
- Review and update the strategy and programme. Feed what you learn back into step one.
The sixth step loops to the first. That loop is the point: monitoring that never changes the strategy is not continuous.
The three tiers
ISCM is organised across three tiers, mirroring SP 800-37 and SP 800-39:
- Tier 1: organisation. Strategy and risk tolerance set at the top.
- Tier 2: mission/business processes. Monitoring tied to what each process needs.
- Tier 3: information systems. Monitoring of the systems themselves.
Where it sits among other NIST publications
SP 800-137 builds on the monitoring concepts in SP 800-37 Revision 1, the Risk Management Framework (RMF), where Monitor is Step 6. ISCM supports that step and ongoing authorisation. The guideline also notes that many SP 800-53 technical controls are good candidates for automated monitoring. Its companion is SP 800-137A.
Read the primary text at NIST's published PDF.
Frequently asked questions
NIST 800-137 is guidance NIST issued under FISMA for US federal information systems, consistent with OMB Circular A-130, the federal policy on securing agency systems. It does not apply to national security systems without approval from the relevant federal officials. A private firm is bound by it only when a contract or customer requires it.
No. NIST SP 800-137 is guidance, not a certifiable standard, so there is no certificate and no certification body for it. The nearest thing to a formal check is an ISCM programme assessment, which NIST describes in SP 800-137A (May 2020). It tells leadership how effective and complete the monitoring programme is.
The six steps in NIST 800-137 are define, establish, implement, analyse and report, respond, and review and update. The first two set the design: the strategy rests on risk tolerance and clear visibility of assets, vulnerabilities and threats, and the programme fixes the metrics, how often status is monitored and how often controls are assessed.
In NIST 800-137, governance, risk management goals and organisational risk tolerance at Tier 1 drive the ISCM strategy. Tier 2 sets monitoring criteria by how each mission or business process is prioritised, and tracks organisation-wide controls such as programme management. Tier 3 monitors individual systems and feeds ongoing authorisation decisions.
NIST 800-137 builds on SP 800-37's monitoring step and draws on SP 800-53 for the controls being monitored. A third publication, SP 800-53A, supplies its definition of control effectiveness: the extent to which controls are implemented correctly, operate as intended and produce the desired outcome against the system's security requirements.
The current version of NIST 800-137 is the final text from September 2011, and NIST lists no draft revision. Its references have moved on: the 2011 text builds on SP 800-37 Revision 1, which NIST replaced with Revision 2 in December 2018, and cites SP 800-53, now at Revision 5. Read it alongside the current versions of both.