What is the FIRST step when developing an Information Security Continuous Monitoring (ISCM) program?

Establishing the ISCM technical architecture is a later implementation step (Step 3 in NIST SP 800-137) that occurs after the strategy and program details have already been defined.

Collecting security-related information for metrics, assessments, and reporting is Step 5 in the ISCM process, occurring only after the strategy, program, and technical architecture have been established.

Establishing the ISCM program by determining metrics, monitoring frequencies, and control assessment frequencies is Step 2, which follows the initial strategy definition and relies on the risk tolerance already identified in Step 1.

According to NIST SP 800-137, the first step in the ISCM process is to define an ISCM strategy based on the organization's risk tolerance, mission, and business needs. This strategy establishes the overarching direction and priorities that guide all subsequent steps, ensuring that monitoring activities are aligned with organizational risk decisions before metrics, architectures, or data collection are configured.