Which NIST special publication is the guide on continuous monitoring? Response:

NIST SP 800-160 is related to Systems Security Engineering, not continuous monitoring.

NIST SP 800-137, "Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations," is the definitive guide that outlines the processes and technical capabilities required to implement an ISCM program. The publication specifies how to continuously monitor, assess, and update security controls to maintain an ongoing awareness of the security posture.

NIST SP 800-168 focuses on identifying and protecting controlled unclassified information (CUI), not continuous monitoring.

NIST SP 800-37 is the Risk Management Framework, which includes continuous monitoring as a step, but SP 800-137 is the specific guide *on* continuous monitoring.