Lion Cipher Lab
Run continuous monitoring and keep an authorization alive (the NIST RMF monitor step)
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
An authorization is a photograph of risk taken on one specific day, and it starts going stale the moment the ink dries. Somebody installs a package, a certificate expires, a contractor's account is never removed, a new vulnerability lands in a library you shipped eighteen months ago — and the document on file still describes a system that no longer exists. The old answer was to redo the entire assessment every three years, which is enormously expensive and tells nobody anything useful for thirty-five of those thirty-six months. The modern answer is continuous monitoring: a small, automated,…
What you'll learn
- writing an ISCM (continuous monitoring) strategy
- deriving monitoring frequencies from risk rather than habit
- automating dated security evidence collection
- diffing evidence to detect configuration drift
- change control as a security input
- POA&M lifecycle and closure evidence
- ongoing authorization and reauthorization triggers
- writing a monthly security status report
Steps in this lab
- The day after the signature: what monitoring is actually for
- Write the ISCM strategy — what, how, how often, who, and what triggers action
- Derive the frequencies — the part everyone guesses at
- Build the collector — automated, dated evidence on Linux or macOS
- The Windows equivalent, and putting both on a schedule
- Read the delta: diff this month against last month
- Change as a monitoring input: what invalidates the SSP
- Keep the POA&M alive — and what 'closed' actually requires
- Ongoing authorization vs. reauthorization, and the four moves an AO can make
- Report up: the one page an executive will actually read
- When this is overkill, and how a professional does it better