ongoing assessment and authorization

{
  "id": "MLC-T-CYB-002942",
  "term": "ongoing assessment and authorization",
  "field": "Cybersecurity",
  "definition": "1. Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.\nNote: The terms “continuous” and “ongoing” in this context mean that security controls and organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security decisions to adequately protect organization information.\nSee organizational information security continuous monitoring and automated security monitoring.\n\n2. See information security continuous monitoring (ISCM).\n\n3. The continuous evaluation of the effectiveness of security control or privacy control implementation; with respect to security controls, a subset of Information Security Continuous Monitoring (ISCM) activities.\n\n4. The continuous evaluation of the effectiveness of security control implementation; it is not separate from ISCM but in fact is a subset of ISCM activities.",
  "abbreviation": "OA",
  "synonyms": [
    "information security continuous monitoring (ISCM)"
  ],
  "references": [
    "CNSSI 4009-2015 from NIST SP 800-137",
    "CNSSI 4009-2015; CNSSI 4009-2015",
    "NIST SP 800-53A Rev. 4 [Superseded]; NIST SP 800-53A Rev. 5",
    "NISTIR 8011 Vol. 1",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/ongoing-assessment-and-authorization/"
}