/continuous-monitoring-setup

description: Set up NIST 800-53 continuous monitoring per RA-5, SI-4, and CA-7

NIST 800-53 Continuous Monitoring Setup

Establishes comprehensive continuous monitoring program compliant with NIST 800-53 requirements (RA-5, SI-4, CA-7), including vulnerability scanning, security event monitoring, configuration management, and automated reporting for FedRAMP and other authorizations.

Usage

/nist:continuous-monitoring-setup [program-type] [options]

Arguments

• `$1` - Program type (optional): "fedramp", "fisma", "standard" (default: "standard")
• `$2` - Options (optional): `--environment=cloud|hybrid`, `--auto-deploy`, `--skip-fedramp-reports`

Examples

# Set up standard NIST 800-53 continuous monitoring
/nist:continuous-monitoring-setup standard

# Set up FedRAMP continuous monitoring (monthly reports)
/nist:continuous-monitoring-setup fedramp

# Auto-deploy monitoring stack
/nist:continuous-monitoring-setup fedramp --auto-deploy

# Cloud-only monitoring (skip on-prem tools)
/nist:continuous-monitoring-setup standard --environment=cloud

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
NIST 800-53 CONTINUOUS MONITORING SETUP
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Program Type: FedRAMP Continuous Monitoring
Environment: Cloud (AWS)
Compliance Requirements:
  - NIST 800-53 Rev 5
  - FedRAMP Moderate Baseline
  - Monthly deliverables to FedRAMP PMO

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PHASE 1: VULNERABILITY SCANNING (RA-5)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

NIST Requirement:
  RA-5: The organization scans for vulnerabilities in the information system
        and hosted applications [Assignment: organization-defined frequency
        and/or randomly in accordance with organization-defined process].

  RA-5(1): Employ vulnerability scanning tools that include the capability to
           readily update the list of information system vulnerabilities.

  RA-5(2): Update the list of information system vulnerabilities scanned prior
           to a new scan.

  RA-5(5): Implement privileged access authorization to [Assignment:
           organization-defined information system components] for selected
           vulnerability scanning activities.

FedRAMP Requirement:
  - Monthly vulnerability scans (authenticated/credentialed)
  - All assets must be scanned
  - Report submitted to FedRAMP within 30 days
  - POA&M for any findings >30 days old

Implementation:

Step 1: Deploy Vulnerability Scanning Tool

  Option A: Amazon Inspector (AWS Native - RECOMMENDED)
    ✓ Pros: Native integration, agent-based, continuous scanning
    ✓ Cons: AWS-only, requires SSM agent

    Deployment:
    ```bash
    # Enable Inspector in all regions
    aws inspector2 enable --resource-types EC2 ECR LAMBDA

    # Deploy SSM agent to EC2 instances
    aws ssm create-association \
      --name "AWS-ConfigureAWSPackage" \
      --targets "Key=instanceids,Values=*" \
      --parameters '{"action":["Install"],"name":["AmazonInspector"]}'

    # Configure automated findings export
    aws inspector2 create-findings-report \
      --report-format JSON \
      --s3-destination bucketName=compliance-reports

Cost: $0.09/instance/month + $0.01/scan for Lambda

Option B: Tenable.io (Industry Standard) ✓ Pros: FedRAMP authorized, comprehensive coverage, widely accepted by 3PAOs ✓ Cons: Additional cost, requires credential management

Deployment:

    # Deploy Tenable Cloud Connector
    # (Terraform module provided)
    terraform apply -target=module.tenable_connector

Cost: $2,500/year (up to 65 assets)

Option C: Qualys VMDR ✓ Pros: FedRAMP authorized, cloud agent-based, dashboard ✓ Cons: Cost

Cost: $1,995/year (up to 100 assets)

RECOMMENDATION: Use Inspector for continuous scanning + Tenable for monthly FedRAMP scans (3PAO accepts Tenable reports)

Step 2: Configure Authenticated Scanning (RA-5(5))

AWS Inspector:

• Uses SSM agent (already has credentialed access)
• Automatically scans packages, network reachability, CVEs
• No additional credential configuration needed

Tenable:

• Create read-only IAM user: tenable-scanner
• Grant permissions: ec2:Describe*, ssm:Describe*, rds:Describe*
• Store credentials in Tenable Cloud

    # Create scanner IAM user
    aws iam create-user --user-name tenable-scanner
    aws iam attach-user-policy --user-name tenable-scanner \
      --policy-arn arn:aws:iam::aws:policy/SecurityAudit

    # Create access key (store securely in Tenable)
    aws iam create-access-key --user-name tenable-scanner

Step 3: Schedule Monthly Scans (FedRAMP Requirement)

EventBridge Rule: monthly-vulnerability-scan

• Schedule: First Monday of each month, 2 AM UTC
• Target: Lambda function → trigger Tenable scan
• Notification: Email to security team when scan starts

    aws events put-rule \
      --name monthly-vulnerability-scan \
      --schedule-expression "cron(0 2 ? * 2#1 *)" \
      --description "Monthly FedRAMP vuln scan"

    aws events put-targets \
      --rule monthly-vulnerability-scan \
      --targets "Id"="1","Arn"="<lambda-arn>"

Step 4: Automated Vulnerability Remediation

Critical/High Vulnerabilities:

• Automated patching via SSM Patch Manager
• Patch within 30 days (FedRAMP requirement)
• Exceptions documented in POA&M

    # Create patch baseline
    aws ssm create-patch-baseline \
      --name "FedRAMP-Patch-Baseline" \
      --approval-rules "PatchRules=[{PatchFilterGroup={PatchFilters=[{Key=CLASSIFICATION,Values=[Security]}]},ApproveAfterDays=7}]"

    # Schedule automated patching (weekly)
    aws ssm create-maintenance-window \
      --name "Weekly-Security-Patching" \
      --schedule "cron(0 3 ? * SUN *)" \
      --duration 4 \
      --cutoff 1

Step 5: Vulnerability Reporting

M