CA.L2-3.12.3
Security Control Monitoring
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CA.L2-3.12.3 in the reference catalog with its NIST cross-references
Official requirement
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Assessment objectives
a. security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Monitor security controls on an ongoing basis for continued effectiveness.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for ensuring your company fulfills all cybersecurity requirements for its DoD contracts. You review those requirements and the security controls your company has put in place to meet them. You then create a plan to evaluate each control regularly over the next year. You mark several controls to be evaluated by a third-party security assessor. You assign other IT resources in the organization to evaluate controls within their area of responsibility. To ensure progress you establish recurring meetings with the accountable IT staff to assess continuous monitoring progress, review security information, evaluate risks from gaps in continuous monitoring, and produce reports for your management [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Security planning policy; organizational procedures addressing system security plan development and implementation; procedures addressing system security plan reviews and updates; enterprise architecture documentation; system security plan; records of system security plan reviews and updates; other relevant documents or records
Common mistakes
Treating a periodic assessment as the only check between major system changes.