Towards Approaches to Continuous Assessment of Cyber Risk in Security of Computer Networks

For authoritative definitions related to CMRS one may consult NIST publication SP 800-137 [NIST 2011], where Information Security Continuous Monitoring is defined as “... maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions, ” or DISA, which defines CMRS as “...visibility of cyber risks and demonstrates the ability to use DOD Enterprise security tools and content,” and continuous monitoring as “...the on–going observation, assessment, analysis, and diagnosis of an organization’s cybersecurity posture, hygiene, and operational readiness” (http://www.disa.mil/Services/Information-Assurance/SCM/CM-Definition )