4.4 Monitoring Controls
Implemented controls must be aligned with IT security and policies and should be reviewed at frequent intervals to determine its effectiveness, efficiency and adequacy.
For monitoring the controls, relevant data should be gathered from various sources in a timely and accurate manner.
Once the data is validated, analysis can be performed against specific control objectives.
If results of the monitoring indicate an area of noncompliance or unacceptable performance, the risk practitioner should discuss with the risk owner (mostly business process owner) and recommend review of existing controls in terms of effectiveness and if require, implementation of additional controls.
Control monitoring can be done either through independent reviewer or self- assessment by process owners.
Following are some of the control monitoring sources:
Security operation centre (SOC) and network operations centre (NOC)
Tools and software for continuous control monitoring
Periodic control testing
Control self-assessment
It is important to monitor the KRIs at periodic intervals as the risk profile changes over the time. Periodic monitoring helps to address the new risk and control the existing risks. For example, a product defect upto 10% is acceptable and KRI is set accordingly. However, over a period of time this 10% is considered too high owning to change in market scenario and KRI needs to be revised to set defect ratio upto only 2%.
Risk profile provides overall risk status that the organization is exposed to. Risk profile is to be kept updated with new and emerging risk so as to ascertain organization’s current risk status.
Whenever a monitoring process identifies a security exception, the first step for a risk practitioner is to validate the exception to rule out any false positives.
Role of a risk practitioner in the control monitoring process is to assist in planning, reporting and scheduling tests.
Continuous Monitoring System
Continuous monitoring is the process and technology used to monitor critical areas on an ongoing basis. There are various tools and techniques available for continuous monitoring. It must be noted that continuous monitoring involves cost and hence organization generally uses continuous monitoring technique for high risk areas whether impact and frequency of occurrence is high.
KRI Thresholds
Thresholds identified for monitoring and reporting of KRI is a key aspect in the monitoring process. It indicates whether controls are providing their intended value. Without appropriate thresholds, the organization may not be able to determine the effectiveness of the control.
KRI should have capability to identify the effectiveness of the controls. KRI should be able to identify when controls are no longer providing their intended value. This helps to take appropriate action on a timely basis. Without this information, an organization may be under the impression that ineffective controls are still effective and do not need to be reworked.