MFA coverage drops after a clinic acquisition
CA-7 dashboard shows MFA < 90% at the new site. Response onboards users within two weeks before remote EHR access expands.
Continuous Monitoring
High Risk
Moderate
Medium Cost
CA-7 requires developing a continuous monitoring strategy, establishing metrics, ongoing monitoring of control status according to the strategy, correlation and analysis, response actions, and reporting to designated officials. Continuous monitoring keeps ePHI protections visible between annual CA-2 assessments.
Control Objective
Operate an ongoing program of metrics and sensors that shows whether key security controls remain effective — and drives response when they degrade.
Implementation Guidance
- Select high-value metrics: patch compliance, MFA coverage, EDR coverage, backup success, open critical vulns, phish report rate, terminated-user revoke time.
- Automate collection from IdP, EDR, backup, vuln scanner, and ticketing.
- Define thresholds and response playbooks when metrics breach.
- Report dashboards to IT/security leadership on a set cadence.
- Correlate monitoring with SI-4 detections and AU-6 reviews.
- Update the strategy when systems or threats change.
- Feed continuous monitoring results into risk posture and authorization decisions.
- Avoid vanity metrics — prioritize controls that protect ePHI.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Backup failure streak
Nightly backup success metric fails three nights. On-call fixes storage quotas — CP-9 health caught by CA-7 before ransomware season.
Monthly security metrics to the board
Leadership sees trends in critical vulns and revoke SLAs, funding SI-2 and AC-2 improvements.
Best Practices
- Few meaningful metrics over many weak ones.
- Automated collection with human review.
- Thresholds tied to response actions.
- Leadership reporting cadence.
- Link to CA-2 assessment planning.
- Include BA/cloud control health where measurable.
Common Gaps & Violations
- Tools deployed but no defined metrics strategy.
- Metrics never reviewed by leadership.
- No response when thresholds breached.
- Annual assessment only — nothing in between.
- Tracking uptime only, ignoring security control health.
Required Documentation
- Continuous monitoring strategy
- Metrics catalog with thresholds/owners
- Sample dashboards / reports
- Response records for breached metrics
- Strategy review/update history
How to Test & Validate
- Verify metrics are current (not stale data).
- Confirm a breached threshold produced a ticket/response.
- Review last leadership monitoring report.
- Map metrics to critical ePHI controls.
- Check strategy update after a major system change.
Audit Considerations
Show ongoing visibility into control health. Continuous monitoring evidence strengthens HIPAA evaluation and risk management narratives.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(8) Evaluation — ongoing evaluation activities complement periodic assessments.
- 164.308(a)(1)(ii)(D) Information System Activity Review — continuous review of activity/metrics.
- 164.308(a)(1) Risk Management — monitoring verifies measures remain effective.
- 164.316 Documentation — retain monitoring strategy and reports as appropriate.
Compliance Tips
- Start with 5–7 metrics you can automate reliably.
- Put CA-7 metrics on the same monthly ops meeting as clinical IT.
- Use monitoring gaps as RA-3 risks until instrumented.
Frequently Asked Questions
Is SIEM the same as CA-7?
SIEM can supply data, but CA-7 is the strategy of metrics, analysis, response, and reporting for control status — broader than intrusion alerts alone.
How does CA-7 relate to CA-2?
CA-2 is periodic deeper assessment; CA-7 is ongoing monitoring between assessments.
What metrics matter most for small clinics?
MFA coverage, patch compliance, backup success, endpoint protection coverage, and timely access revocation are strong starters.
References & Resources
- NIST SP 800-53 Rev. 5 — CA-7
- NIST SP 800-137 Information Security Continuous Monitoring
- Related controls: CA-2, SI-4, RA-5, AU-6, SI-2
Related Guidelines
Related controls that commonly accompany CA-7.
Need Help Implementing CA-7?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.