Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

For security controls to remain effective they must be reviewed to determine if they are accomplishing the intended goal. As your systems, businesses process, and people change the effectiveness of your controls may diminish. Ongoing monitoring ensure that issues with your security controls are identified and corrected. Provide a plan for monitoring and assessing the state of security controls on a recurring basis that occurs more frequently than the periodic assessments discussed in CA.2.158. This monitoring and assessing plan may take the form of a checklist.

Create a checklist of tasks for you to perform on a monthly basis that allows you to monitor the effectiveness of your secuirty controls. The checklist can include checking reports from your anti-malware software, SIEM, and other security tools.