NIST 800-171 R3 03.12.03 Continuous Monitoring at a Glance
- Family: 03.12 Security Assessment and Monitoring (CA)
- Requirement ID: 03.12.03 Continuous Monitoring
- Assessment Objectives (AOs): Four (4) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Control: CA-07
- NIST 800-171 R3 Kill Chain Phase: Phase 11, Situational Awareness (SA)
Continuous Monitoring is the requirement that keeps your view of security current between formal assessments. It completes the Security Assessment and Monitoring (03.12) family, tying Security Assessment (03.12.01) and the Plan of Action and Milestones (03.12.02) into an ongoing process. Continuous Monitoring (03.12.03) requires developing and implementing a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments. Per the NIST discussion, continuous monitoring at the system level supports ongoing awareness of the security posture for risk management decisions, the terms continuous and ongoing imply a frequency sufficient to support risk-based decisions, and different types of security requirements may require different monitoring frequencies.
A common difficulty with this requirement is monitoring in an ad hoc way without a documented strategy. R3 assesses both that a strategy exists and that it is implemented, and that it covers ongoing monitoring and security assessments. Tools running without a strategy that ties their output to risk decisions do not satisfy the requirement.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.12.03 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.12.03 Continuous Monitoring. Only the formatting has been adjusted for readability. This is a single statement with no lettered parts:
- Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.
The source control is CA-07 from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, organizations assess and monitor their systems at a frequency sufficient to support risk-based decisions, and different security requirements may warrant different monitoring frequencies. You can read the requirement directly at NIST 800-171 R3, 03.12.03 (p. 56).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.12.03?
None (0). Requirement 03.12.03 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.12.03 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.12.03?
NIST 800-171A R3 breaks 03.12.03 into four (4) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.12.03[01]: a system-level continuous monitoring strategy is developed.
- A.03.12.03[02]: a system-level continuous monitoring strategy is implemented.
- A.03.12.03[03]: ongoing monitoring is included in the continuous monitoring strategy.
- A.03.12.03[04]: security assessments are included in the continuous monitoring strategy.
The four (4) objectives are developing the strategy, implementing it, and confirming it includes ongoing monitoring and security assessments. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.12.03 (p. 73).
Assessment Methods and Objects for NIST 800-171 R3 03.12.03
Examine: security assessment and monitoring policy and procedures; organizational continuous monitoring strategy; system-level continuous monitoring strategy; procedures for continuous monitoring of the system; procedures for configuration management; security assessment report; plan of action and milestones; system monitoring records; configuration management records; impact analyses; status reports; system security plan.
Interview: personnel with continuous monitoring responsibilities; personnel with information security responsibilities; system administrators.
Test: mechanisms for implementing continuous monitoring; mechanisms for supporting response actions for assessment and monitoring results; mechanisms for supporting security status reporting.
How Does NIST 800-171 R3 03.12.03 Map From NIST 800-171 R2?
03.12.03 maps from NIST 800-171 R2 requirement 3.12.3 (monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls):
- A.03.12.03[01] through A.03.12.03[04] all map indirectly to elements of R2 3.12.3 (security controls are monitored on an ongoing basis).
Mapped against the four (4) AOs, all four (4) are indirect (moderate effort), with no net-new AOs and none with no mapping. The ongoing monitoring concept carries forward, but R3 reframes it as a documented, implemented strategy that must explicitly include both ongoing monitoring and security assessments. Confirm your monitoring is captured in a strategy rather than performed informally.
How Does NIST 800-171 R3 03.12.03 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.12.03 through the following SCF controls:
- GOV-09 Steering Committee & Program Oversight
- GOV-09.1 Status Reporting To Governing Body
- GOV-12 Measures of Performance
- CPL-05 Conformity Monitoring
- CPL-05.1 Functional Review Of Security, Compliance & Resilience Controls
- CPL-07 Executive Leadership Oversight of Security, Compliance & Resilience Controls
- MON-02 Continuous Monitoring
- TDA-02 Technology Development & Acquisition
- TDA-06 Product Management
- TDA-06.2 Continuous Monitoring Plan
- TDA-17 Security, Compliance & Resilience Testing Throughout Development
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.12.03
The following are issues teams may encounter rather than certainties. They are about the strategy and its coverage, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- A strategy, not just tools. A.03.12.03[01] and [02] require developing and implementing a monitoring strategy. Running monitoring tools without a documented strategy leaves these objectives open.
- Include ongoing monitoring and assessments. A.03.12.03[03] and [04] require the strategy to cover both ongoing monitoring and security assessments, so a strategy that addresses only one is incomplete.
- Set frequencies to support decisions. Per the NIST discussion, the monitoring frequency should be sufficient to support risk-based decisions, and different requirements may need different frequencies.
- Feed the family. Continuous monitoring findings drive Risk Response (03.11.04) and updates to the Plan of Action and Milestones (03.12.02), so keep the outputs connected.
What Is Reasonable Evidence For NIST 800-171 R3 03.12.03?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.12.03 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.12.03 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-CPL-05 Internal Audit (IA) Findings. A centrally-managed and prioritized repository internal audit (ia) findings.
- E-CPL-07 Control Assessments. Internal or third-party control assessments to provide governance oversight of cybersecurity & data privacy controls.
- E-CPL-08 Functional Review of Cybersecurity Controls. Control testing to ensure cybersecurity controls function as expected.
- E-CPL-09 Non-Compliance Oversight Reporting. Governance oversight reporting of non-compliance to the organization's executive leadership.
- E-GOV-09 Charter - Cybersecurity Steering Committee. An executive steering committee, or advisory board, that is formed to perform oversight of cybersecurity management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.
- E-GOV-10 Charter - Data Privacy Steering Committee. An executive steering committee, or advisory board, that is formed to perform oversight of privacy management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.
- E-GOV-11 Charter - Audit Committee. An executive steering committee, or advisory board, that is formed to perform oversight of internal and external audit management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.
- E-GOV-12 Charter - Risk Committee. An executive steering committee, or advisory board, that is formed to perform oversight of risk management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.
- E-GOV-13 Charter - Data Management Board (DMB). The organization's data management board (dmb) charter and mission.
- E-GOV-14 Measures of Performance (Metrics). Formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, kpis, kris).
- E-GOV-18 Cybersecurity & Data Privacy Status Reports. Status reports of the organization's security, compliance and/or resilience program that were submitted to applicable statutory and/or regulatory authorities.
- E-MON-01 Event Log Review & Analysis. A capability to perform security event log review and analysis (e.g., system monitoring records, continuous monitoring strategy, etc.).
- E-PRM-06 Quarterly Business Review (QBR). A quarterly business review (qbr), or similar process, to provide recurring status reports on the current state of the cybersecurity and data protection program.
- E-TDA-02 Secure Engineering & Data Privacy (SEDP). A secure engineering & data privacy (sedp) program. this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.
- E-TDA-03 Application Security Testing (AST). Application security testing (e.g., dast, sast, fuzzing, etc.).
- E-TDA-04 Design and Development Plan (DDP). An engineering method to control the design process and govern the lifecycle of the product/service.
Alongside these, keep the System Security Plan (SSP) narrative for 03.12.03.
Timeline Considerations for NIST 800-171 R3 03.12.03
With all four (4) AOs mapping indirectly, 03.12.03 is a moderate lift centered on documenting the strategy. A realistic sequence:
- Develop a system-level continuous monitoring strategy (A.03.12.03[01]).
- Ensure the strategy includes ongoing monitoring and security assessments (A.03.12.03[03] and [04]).
- Implement the strategy across the system (A.03.12.03[02]).
- Connect monitoring outputs to risk response and the plan of action and milestones.
- Collect evidence for all four (4) AOs, including the strategy document and evidence of its implementation.
Frequently Asked Questions About NIST 800-171 R3 03.12.03
How many assessment objectives does NIST 800-171 R3 03.12.03 have? NIST 800-171A R3 breaks 03.12.03 into four (4) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.12.03 come from? CA-07.
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.12.03 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.12.03 sit in the NIST 800-171 R3 Kill Chain? Phase 11, Situational Awareness (SA). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.12.03
03.12.03 Continuous Monitoring develops and implements a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments. It maps from R2 3.12.3 with all four (4) assessment objectives transitioning indirectly, reframed as a documented strategy. The recurring problem is monitoring without a strategy. Document the strategy, make sure it covers ongoing monitoring and assessments, implement it, and feed the results into risk response and your plan of action and milestones.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
