NIST 800-171 Controls · Security Assessment
CA.2.003 — Monitor Security Controls Continuously
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
What CA.2.003 means in plain English
Security is not a one-time setup. You need to keep an eye on your protections all the time — not just once a year. This means regularly checking that antivirus is up to date, patches are being applied, backups are completing successfully, and your firewall rules have not been changed. Set up automated alerts where you can. At a minimum, do a monthly check of your critical controls. Think of it like checking the oil in your truck — do not wait until the engine seizes.
The assessment question
“Do you continuously or at least monthly monitor the effectiveness of your security controls through automated tools, regular reviews, or dashboard checks to ensure they remain operational and effective?”
How to implement CA.2.003
- Set up Windows Defender to email you if antivirus definitions are out of date or if a threat is detected. In Windows Security > Virus & Threat Protection, enable notifications.
- Create a monthly security controls checklist: verify antivirus is current, verify patches are applied, check backup completion logs, verify firewall rules, review active user accounts, and check physical access logs.
- If using Microsoft 365 GCC, check the Security Dashboard at security.microsoft.com at least weekly for alerts, risky sign-ins, and compliance scores.
- Set up automated monitoring where possible: use Windows Task Scheduler to run scripts that check critical services, or use a free tool like Uptime Robot to monitor availability.
- Document your continuous monitoring activities in a log. Even a simple spreadsheet with date, what was checked, findings, and actions taken satisfies the requirement.
Evidence your assessor will ask for
- Continuous monitoring plan or strategy document describing what is monitored and how frequently
- Monthly security control review checklists (completed and signed)
- Automated monitoring tool dashboards or alert configuration screenshots
- Log of monitoring activities and any issues discovered with remediation actions
- Evidence that monitoring findings feed into the POA&M and risk assessment processes
Does AI prompt monitoring help with this control? Honestly, no.
CA.2.003 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Security Assessment controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.