{"description":"Run the continuous controls monitoring (ISCM) cycle: pull the current-period control metrics and score them against thresholds, triage degraded and failed controls, update the POA&M, report control health to governance, recalibrate the monitoring strategy, then classify the disposition and prepare, hand off, and archive the cycle package. Each interval runs as one workflow instance attached to the existing Process item that represents the ISCM / continuous-controls-monitoring program (process_type = security_process) — enrich that program record every cycle, never create a duplicate. The monitored control set is the existing Control items (Control.frequency doubles as the monitoring cadence, Control.control_owner as the accountable owner) and the POA&M is the existing Issue register (issue_type = deficiency, source = self_assessment); metric definitions and pass/degraded/fail threshold bands have no native field, so they live in the ISCM strategy document carried on the anchor Process item. The cycle produces the control-health scorecard, the reconciled POA&M, the control-health / security-status report, and the recalibrated ISCM strategy. In scope: the recurring NIST 800-137 monitoring loop — metric collection, threshold comparison, triage, POA&M maintenance, security-status reporting, and monitoring-strategy tuning for the controls under continuous monitoring. Out of scope: formal security control assessment and driving gap remediation to closure, which is owned by the downstream Security Control Assessment & POA&M Remediation workflow that consumes this cycle's handoff package. No upstream workflow feeds this one; it is triggered by the arrival of the monitoring interval.","edges":[{"id":"e-classify-disposition-create-action-plan","label":"Action","source":"classify-disposition","target":"create-action-plan","whenValue":"gaps"},{"id":"e-classify-disposition-handoff-to-related-workflow","label":"Clear","source":"classify-disposition","target":"handoff-to-related-workflow","whenValue":"complete"},{"id":"e-classify-disposition-escalate-or-accept-risk","label":"Escalate","source":"classify-disposition","target":"escalate-or-accept-risk","whenValue":"monitor"},{"id":"e-create-action-plan-handoff-to-related-workflow","source":"create-action-plan","target":"handoff-to-related-workflow"},{"id":"e-escalate-or-accept-risk-handoff-to-related-workflow","source":"escalate-or-accept-risk","target":"handoff-to-related-workflow"}],"isPublic":true,"metadata":{"capabilities":[],"controlVerbs":{},"controls":["UC-LOG-04","UC-AUDIT-21","UC-RISK-14","UC-RISK-13","UC-GOV-33"],"department":"it","domains":["controls"],"library":{"aliases":[],"canonicalUrl":"https://workflow-library.com/all/?w=controls-continuous-controls-monitoring-iscm","contentDigest":"sha256:c1eba4819d732a63c86422514455ba1cffacc57cfca35373d63457d0e5694c14","prerequisites":{"status":"undeclared"},"provenance":[],"releaseId":"sha256:c1eba4819d732a63c86422514455ba1cffacc57cfca35373d63457d0e5694c14","schemaVersion":1,"sourceTemplateId":"workflow-library:controls-continuous-controls-monitoring-iscm"},"lineOfDefense":"monitor","mappingStatus":"mapped","risks":[],"slug":"controls-continuous-controls-monitoring-iscm","source":"coworkcanvas-gallery","standards":["nist-800-53","nist-csf-2"],"teams":["it","risk-management"]},"name":"Continuous Controls Monitoring (ISCM) Cycle","nodes":[{"data":{"decisionField":"disposition_path","description":"Judge real control failures versus metric defects, rate exposure and residual appetite, and classify the reconciled monitoring result as complete, gaps or monitor.","formData":{"fields":[{"key":"disposition_path","label":"Classify disposition","options":[{"label":"Complete","value":"complete"},{"label":"Gaps require action","value":"gaps"},{"label":"Monitor without immediate action","value":"monitor"}],"required":true,"type":"select"}],"resultType":"form","submittedAt":null,"values":{}},"instructions":"**Objective** — Judge real control failures versus metric defects, rate exposure and residual appetite, and classify the reconciled monitoring result as complete, gaps or monitor.\n\n**Inputs**\n- The anchor: the existing Process item for the ISCM / continuous-controls-monitoring program (process_type = security_process) — this cycle attaches to and enriches it, it is not created here. Its ISCM strategy document (carried forward from the prior cycle's close step) defines the monitored control set, each control's metric definition, and the pass / degraded / fail threshold band — the parameters that have no native field.\n- The monitored control set as the existing Control items: Control.frequency is the monitoring cadence, Control.control_owner the accountable owner, Control.family/domains for roll-up, plus the Control ↔ Process relationship for the system/process each protects (UC-RISK-13, UC-RISK-14, UC-GOV-33).\n- Current-period evidence extracts uploaded to this step (PBC/external): automated telemetry, log and event aggregators (UC-LOG-04, UC-AUDIT-21), configuration and vulnerability scanners, IAM/access-review feeds, and ticketing exports — CSV/XLSX with query parameters recorded.\n- The prior-period scorecard — the XLSX on the previous cycle instance's pull step — and the open POA&M items (open Issue items, issue_type = deficiency, source = self_assessment, linked to their Controls), for trend and delta. No upstream workflow feeds this step; the trigger is the arrival of the monitoring interval.\n- The control-health scorecard (the XLSX document produced by the metrics activities in this checkpoint) — the degraded/failed rows with value, threshold, delta, and trend.\n- The affected Control items with Control.control_owner and the Control ↔ Process relationship for the system/process each protects.\n- The log and event evidence behind each failing metric (UC-LOG-04, UC-AUDIT-21), attached alongside the scorecard.\n- The Risk items linked to the affected controls via Control ↔ Risk (UC-RISK-13 risk identification, UC-RISK-14 risk analysis) and any open POA&M Issue items (issue_type = deficiency) on them.\n- The failures triaged in this checkpoint, with root cause, severity and owner.\n- The existing POA&M / open-findings register, including items carried from prior cycles.\n- The remediation SLA windows by severity and the control/risk owners.\n- The control-health scorecard (statuses and trends).\n- The POA&M register reconciled during this checkpoint (open / overdue / closed items).\n- Control ownership and the governance reporting audience (UC-GOV-33 governance reporting).\n- Prior-period reports, for trend framing.\n\n**Procedure**\n_This checkpoint absorbs “Pull control metrics”, “Triage failed controls”, “Update POA&M”, “Report control health”. The agent runs the preparation, evidence assembly and record updates below; the named owners retain the substantive decisions and approvals stated in the procedure._\n1. Pull control metrics: Enumerate the monitored control set from the ISCM strategy; for each control record its frequency, its metric definition, and the authoritative data source.\n2. Pull the current metric value from that source. Prefer automated, system-generated evidence; where a metric is manual, capture who attests to it and when.\n3. Validate metric completeness and integrity (information produced by the entity / IPE): confirm the pull covers the full population for the period, record the extraction parameters and query, and confirm the source is the system of record. An incomplete or unreproducible pull voids the reading — re-pull before scoring.\n4. Compare each metric to its threshold or tolerance band and assign a status: pass (within tolerance), degraded (in the warning band / drifting toward the limit), or fail (breached). Record the numeric value, the threshold, and the delta for each.\n5. Compute the trend versus the prior period (improving / stable / degrading) and flag any control whose evidence is stale — no fresh reading within its monitoring frequency. Treat a stale metric as a monitoring failure, never a silent pass.\n6. Assemble the control-health scorecard: one row per monitored control with value, threshold, status, trend, and evidence reference.\n7. Triage failed controls: Confirm each failure is real, not a data or collection artifact: re-check the evidence pull and the threshold definition before triaging. A mis-set threshold is a monitoring defect — note it for strategy recalibration rather than raising a control weakness.\n8. Determine root cause and distinguish a design failure (the control cannot meet its objective as built) from an operating failure (the control exists but was not performed, was performed late, or was bypassed).\n9. Assess severity and exposure: what the control protects, whether the failure creates active exposure now, the blast radius, and whether a compensating control limits the impact.\n10. Refresh the risk: tie the failure to its risk-register entry (UC-RISK-13, UC-RISK-14); where the failure pushes residual risk above appetite, mark it for escalation.\n11. Prioritize: rank the failures by severity times exposure, map each to an accountable owner, and identify any that need immediate interim mitigation before the formal plan is built.\n12. Update POA&M: For each new weakness, open a POA&M entry: weakness description, source (this ISCM cycle and date), the affected control and risk, root cause, and the accountable owner.\n13. Set the scheduled completion date from the severity-based SLA and define interim milestones; record the resources required and any dependency.\n14. Reconcile every existing open POA&M item using this cycle's metric as the check on whether the prior remediation actually held: mark each progressing, completed (with validation evidence), overdue, or re-opened.\n15. Close an item only on validation evidence that the control now meets its threshold — a green metric this cycle for a control that failed last cycle is the close evidence. Never close on assertion alone.\n16. Flag overdue or repeatedly-slipped items for escalation and record the slip reason.\n17. Report control health: Aggregate posture: count controls pass/degraded/fail and roll the counts up by control family/domain and by system, so the report shows where weakness concentrates rather than a single flat number.\n18. Show trend: period-over-period movement, newly-failing versus newly-recovered controls, and any control failing across multiple periods (chronic). Call chronic failures out explicitly — they signal a design problem, not noise.\n19. Summarize remediation: open POA&M count by severity, overdue count, and items closed this period with validation evidence.\n20. Translate to risk language for governance: what the current posture means for residual risk versus appetite and which items need leadership attention.\n21. Tailor the view to the audience (operational owners versus governance/executive) and stage it for distribution to the control owners and the governance forum.\n\n**Decision criteria**\n- `complete` (Complete): all monitored controls pass, or the only degradations were closed within the cycle with validation evidence; no open weakness needs a new action plan and residual risk sits within appetite. Proceeds straight to the final package.\n- `gaps` (Gaps require action): the cycle surfaced control failures now recorded as open POA&M entries that need an owned remediation action plan, and residual risk is within appetite once that plan executes. Routes to build the action plan.\n- `monitor` (Monitor without immediate action): a degradation or accepted weakness that does not warrant remediation now but must be watched, or a residual risk that needs an accountable authority to escalate or formally accept. Routes to escalate or accept the risk.\n\n**Record in AssureSwarm**\n- Attach the control-health scorecard as the XLSX step document — one row per monitored control with value, threshold, pass/degraded/fail status, trend, and a reproducible evidence reference (coach-document-upload). The six-type schema has no per-control monitoring-result type and no health field on Control, so this scorecard document is the reading of record for the period (candidate future type: Monitoring Result).\n- Source the current metrics, the control register, and the prior-period scorecard and POA&M via coach-query-data over the Control, Issue, and Risk items.\n- Attach the triage analysis as the step document (coach-document-upload) — root cause, design-vs-operating classification, severity/exposure, and owner per failed control; design-vs-operating has no native field, so the triage document and the Issue's root_cause carry it.\n- For a failure already tracked as an open POA&M Issue, update Issue.root_cause and Issue.severity; a not-yet-tracked failure carries its detail from the triage document into the POA&M planning activities in this checkpoint (coach-item-update).\n- Link each failure to its Risk item (Issue ↔ Risk) and its Control (Issue ↔ Control) (coach-items-link); pull supporting evidence via coach-query-data.\n- Create one Issue per new weakness as the POA&M entry — issue_type = deficiency, source = self_assessment, severity, root_cause, remediation_plan, issue_owner, identified_date, and target_remediation_date (set from the severity-based SLA) (coach-item-create).\n- Reconcile each prior open Issue: set actual_remediation_date and verified_date on a validated close (the green metric this cycle is the close evidence), and record slip reasons in management_response for overdue items (coach-item-update).\n- Link each POA&M Issue to its failed Control (Issue ↔ Control) and its Risk (Issue ↔ Risk) (coach-items-link), and attach the green-metric validation evidence for any closed item as a step document (coach-document-upload).\n- Build the control-health dashboard — pass/degraded/fail posture, trend, and open/overdue POA&M status rolled up by control family and system (coach-dashboard-create).\n- Attach the control-health / security-status report (PDF/DOCX) as the step document (coach-document-upload) and distribute it to the control owners and the governance forum (coach-notify).\n- Submit the `disposition_path` SELECT with the chosen branch value (`complete`, `gaps`, or `monitor`).\n- Record the decision rationale and evidence references in the step result, and name the decision owner or approver.\n\n**Exit criteria**\n- The scorecard is complete for every monitored control with value, threshold, pass/degraded/fail status, trend, and a reproducible evidence reference; stale metrics are flagged as failures.\n- Every degraded/failed control has a documented root cause (design vs operating), a severity/exposure rating, an accountable owner, and a flag for escalation or interim mitigation where warranted.\n- Every triaged weakness has a POA&M entry with owner, milestones, and due date; every prior open item is reconciled to a current status with evidence; overdue items are flagged.\n- A distributed control-health report exists showing pass/degraded/fail posture, trend, chronic failures, and open/overdue POA&M status, tailored to its audience.\n- The `disposition_path` form is submitted with a documented rationale and owner, and the two unused branches are prunable because their edge values match the selected form value.\n\n> **⚡ Audit Artist accelerator:** `/coach-dashboard-create` builds the control-health dashboard from the scorecard and POA&M status; `/coach-notify` distributes it to owners and the governance forum for review.","kind":"decision","label":"Classify disposition","performedBy":{"agent":"grc-artist","note":"metric collection and threshold-scoring engine producing the control-health scorecard control-failure root-cause, severity, and exposure triage POA&M entry creation and prior-item reconciliation control-health status reporting and distribution","primitives":["coach-query-data","coach-document-upload","coach-item-create","coach-item-update","coach-items-link","coach-dashboard-create","coach-notify"]}},"id":"classify-disposition"},{"data":{"description":"Build an owned, dated remediation plan that closes the exposed control gaps","instructions":"**Objective** — Build an owned, dated remediation action plan that closes the control gaps this cycle exposed and drives residual risk back within appetite.\n\n**Inputs**\n- The `gaps` disposition and its rationale.\n- The POA&M entries for the failed controls (root cause, severity, owner) from the update step.\n- Control and risk owners and the appetite thresholds the remediation must satisfy.\n\n**Procedure**\n1. For each gap, state the root cause, the corrective action, and a named accountable owner — a person, not a team.\n2. Set a due date proportionate to severity and the POA&M SLA window already recorded; sequence any dependencies between actions.\n3. Define interim mitigation for any gap that cannot be closed before its due date, so exposure is bounded in the meantime.\n4. Define the validation evidence that will prove each action effective — the specific metric and threshold that must go green next cycle — and the reporting cadence to the owner and governance.\n5. Confirm the post-remediation residual risk lands within appetite; if it will not, flag the item for escalation instead of the action plan.\n\n**Record in AssureSwarm**\n- Write each corrective action into its POA&M Issue: Issue.remediation_plan (corrective action, interim mitigation, and the validation metric/threshold that must go green next cycle), Issue.issue_owner (the named accountable owner), and Issue.target_remediation_date proportional to severity (coach-item-update).\n- Link each POA&M Issue to the affected Control (Issue ↔ Control); where a gap needs a new tracked item, create it as an Issue (issue_type = deficiency) and link it (coach-item-create, coach-items-link).\n\n**Exit criteria** — Every exposed gap has an owned, dated action with interim mitigation, validation evidence tied to a metric/threshold, and a reporting cadence, and post-remediation residual risk is confirmed within appetite (or flagged for escalation).","label":"Create action plan","performedBy":{"agent":"grc-artist","note":"owned remediation action-plan builder","primitives":["coach-item-create","coach-items-link","coach-item-update"]}},"id":"create-action-plan"},{"data":{"description":"Bring a monitored weakness or residual risk to the accountable authority for a governed decision","instructions":"**Objective** — Bring a monitored weakness or residual risk to the accountable authority for a governed decision — escalate for direction or formally accept the risk — with a defensible decision memo.\n\n**Inputs**\n- The `monitor` disposition and its rationale.\n- Quantified impact and residual risk from triage and the control-health report, and the appetite position the item touches.\n- The escalation path: control owner, monitoring/assessor lead, system owner, or authorizing official, per the governance model.\n\n**Procedure**\n1. Prepare a decision memo: the weakness, its quantified impact (operational, regulatory, financial), root cause, residual risk versus appetite, and the options with a recommendation.\n2. Quantify impact in the organization's own terms (loss estimate, regulatory exposure, systems or records affected) so the decision-maker can weigh it.\n3. Route to the correct authority by threshold and capture the decision — direction to remediate, formal risk acceptance with conditions, or further escalation.\n4. If risk is accepted, record the conditions, the acceptance owner, the expiry or review date, and the monitoring trigger that reopens it — tie the trigger to the ISCM metric and threshold so continued monitoring enforces the acceptance.\n5. Define follow-up ownership so the item does not stall after the decision.\n\n**Record in AssureSwarm**\n- Attach the decision memo as the step document (coach-document-upload).\n- For a formal risk acceptance, record it as an Issue with issue_type = policy_exception — exception_approver (the accepting authority), exception_expiry_date (the acceptance's review/expiry date), and the acceptance conditions plus the monitoring trigger (tied to the ISCM metric and threshold) in root_cause/description — linked to the underlying Risk (Issue ↔ Risk), with Risk.treatment set to accept and Risk.residual_rating recorded (coach-item-create, coach-item-update, coach-items-link).\n- For an escalation directing remediation, record the authority's decision, conditions, owner, and follow-up on the affected item (coach-item-update).\n\n**Exit criteria** — The memo is delivered, the accountable authority's decision (direction or conditioned risk acceptance) is recorded with owner and follow-up, and any acceptance carries an expiry and a monitoring trigger tied to the ISCM metric.","label":"Escalate or accept risk","performedBy":{"agent":"grc-artist","note":"monitored-risk escalation and risk-acceptance memo","primitives":["coach-document-upload","coach-item-update","coach-item-create","coach-items-link"]}},"id":"escalate-or-accept-risk"},{"data":{"description":"Approve justified threshold, frequency, coverage and source changes, and accept the assessment/remediation handoff with explicit boundaries and open-risk follow-up.","instructions":"**Objective** — Approve justified threshold, frequency, coverage and source changes, and accept the assessment/remediation handoff with explicit boundaries and open-risk follow-up.\n\n**Inputs**\n- The control-health report and scorecard: false-positive and degraded patterns, chronic failures, and blind spots.\n- The threshold mis-fires flagged during triage (bands set too tight or too loose).\n- Any change to the system boundary, control baseline, or risk profile since the last calibration.\n- Monitoring cost/frequency data and evidence-source reliability.\n- The control-health scorecard, the triage analysis, the reconciled POA&M, and the control-health report.\n- The recalibrated monitoring-strategy changes.\n- Any action plan (gaps path) or decision memo / risk acceptance (monitor path), plus the disposition decision and its owner.\n- Open constraints and residual risk still outstanding at closure.\n- The verified final package from the prepare step, including its downstream-scope note, and the cycle record with all linked evidence, decisions, POA&M entries, and strategy changes.\n- The open POA&M entries and the disposition decision (what remediation must act on), plus any risk-acceptance expiries and monitoring triggers still outstanding.\n- The linkage target: the Security Control Assessment & POA&M Remediation workflow.\n- Records-retention requirements and the ISCM cadence — as recalibrated this cycle — for the next interval.\n\n**Procedure**\n_This checkpoint absorbs “Recalibrate monitoring strategy”, “Prepare final package”. The agent runs the preparation, evidence assembly and record updates below; the named owners retain the substantive decisions and approvals stated in the procedure._\n1. Recalibrate monitoring strategy: Review threshold accuracy: where a metric flagged fail/degraded but triage found no real weakness (or a control passed while a known weakness existed), adjust the threshold or tolerance band and record the rationale.\n2. Review frequency: raise the monitoring frequency for controls that are volatile, high-risk, or chronically failing; consider lowering it for stable, low-risk controls to focus effort where it matters.\n3. Review coverage: add a metric or control for any blind spot the cycle exposed — a material risk with no monitoring signal — and retire metrics that no longer inform a decision.\n4. Reassess evidence sources: replace manual or unreliable sources with automated feeds where possible to improve integrity and timeliness.\n5. Record the proposed strategy changes as a governed update for owner approval. Do not silently change thresholds or frequencies; changes are reviewed so the baseline stays defensible.\n6. Prepare final package: Compile the package: cycle summary and period, control-health posture and trend, triage root causes, POA&M status, the monitoring-strategy changes, the disposition decision with its owner, and any action plan or risk-acceptance memo.\n7. Verify completeness against the cycle records — every failed control triaged and in the POA&M, every disposition rationale present, strategy changes captured. A gap here is a rework signal, not a formatting nit.\n8. State the residual risk and any open constraints plainly, so the downstream reader and the archive both see what remains.\n9. Note explicitly what the downstream Security Control Assessment & POA&M Remediation workflow should consume and should NOT repeat — it drives formal assessment and gap remediation; it does not re-run this cycle's metric collection.\n10. Produce the proposed conclusion and route the package for review.\n11. Handoff to related workflow: Create or link the downstream Security Control Assessment & POA&M Remediation workflow instance and attach the final package as its input handoff.\n12. Carry forward only what remediation needs: the open POA&M items, root causes, severity, owners, and residual risk — not the full telemetry stream.\n13. State the assumptions the package rests on and, explicitly, what the downstream workflow should not repeat — it assesses and remediates; it does not re-collect this cycle's metrics.\n14. Confirm the downstream owner has received and acknowledged the handoff so nothing is dropped at the boundary.\n15. Confirm the remaining closure preconditions: every failed control is in the POA&M with an owner, the disposition is recorded with its owner, and the monitoring-strategy changes are approved.\n16. Archive the final package and lock the cycle's evidence per retention policy so the audit trail is immutable.\n17. Update linked records — set the cycle status to closed, apply the approved monitoring-strategy changes to the control baseline, and update the controls and risks with the cycle outcome.\n18. Schedule the next monitoring interval per the (possibly recalibrated) cadence, plus validation checkpoints for open POA&M items and review/expiry dates for any accepted risk.\n19. Communicate closure and the next-cycle schedule to control owners, stakeholders, and the downstream remediation owner; the cycle owner's closure record on this step is the sign-off that ends the cycle.\n\n**Record in AssureSwarm**\n- Attach the recalibration rationale as the step document, and update the ISCM strategy document carried on the anchor Process item with the threshold, coverage, and evidence-source changes — those parameters have no native field, so the strategy document is their home (coach-document-upload).\n- Record each proposed monitoring-cadence change as a proposed Control.frequency update on the affected Control items — applied to the baseline at close once approved — and link the changes to each affected Control (coach-item-update, coach-items-link).\n- Render and compile the package and attach it to the cycle record (coach-render-package, coach-document-upload).\n- Link the package to the cycle items and the POA&M entries (coach-items-link).\n- Link the package to the downstream workflow (coach-document-link, coach-items-link) and record the handoff acknowledgment and the carried-forward summary on the cycle record.\n- Close the workflow instance as the immutable cycle audit trail and archive/lock the final package per retention policy (coach-item-update, coach-document-upload).\n- Apply the approved monitoring-cadence changes to the baseline as Control.frequency updates on the affected Controls (coach-item-update).\n- Schedule the next monitoring interval per the recalibrated cadence and link the outstanding POA&M Issues (via Issue.target_remediation_date) and any accepted-risk review dates to their owners (coach-items-link, coach-workflow-monitor).\n\n**Exit criteria**\n- A reviewed set of monitoring-strategy changes (threshold, frequency, coverage, source) with rationale is recorded and routed for owner approval; blind spots and threshold mis-fires are addressed or explicitly deferred.\n- A complete, verified evidence-and-decision package — with residual risk, open constraints, and the downstream-scope note — is attached and ready for handoff.\n- The final package is linked to the Security Control Assessment & POA&M Remediation workflow with a carried-forward summary and a no-repeat note, and the downstream owner has acknowledged receipt; the cycle is closed with an immutable archived package; the control baseline reflects the approved strategy changes; the next monitoring interval is scheduled; every open POA&M entry and accepted-risk review has a scheduled owner and date; closure is communicated.\n\n> **⚡ Audit Artist accelerator:** `/coach-render-package` compiles the scorecard, triage, POA&M, strategy changes, and disposition into a single reviewable cycle package.","label":"Handoff to related workflow","performedBy":{"agent":"grc-artist","note":"ISCM strategy threshold/frequency/coverage recalibration final evidence-and-decision package assembler downstream assessment-and-remediation handoff","primitives":["coach-item-update","coach-document-upload","coach-items-link","coach-render-package","coach-workflow-scan"]}},"id":"handoff-to-related-workflow"}],"sourceTemplateId":"workflow-library:controls-continuous-controls-monitoring-iscm"}