What is NIST 800-53 CA-7 Continuous Monitoring?

More context

CA-7 sits in the Assessment, Authorization, and Monitoring family and reflects a shift in how NIST expects security to be verified: authorization is not a one-time event but an ongoing state that must be continually re-evidenced. The control asks organizations to define metrics, monitoring frequencies, and reporting so that changes in posture are detected as they happen rather than discovered at the next scheduled review.

For configuration controls, satisfying CA-7 practically means a scanner that runs on an ongoing cadence and feeds results into the organization's monitoring picture, so drift away from an approved baseline surfaces quickly. Tools that only produce an annual or quarterly assessment cannot demonstrate the ongoing awareness the control calls for, which is why continuous benchmark scanning has become the expected way to evidence it.