Annual testing is not enough. Controls can fail between assessments. CA.L2-3.12.3 requires you to monitor your security controls on an ongoing basis. This does not mean constant hands-on testing, but it does mean you have a mechanism to detect control failures. Continuous monitoring complements CA.L2-3.12.1 (periodic assessments) and feeds findings into CA.L2-3.12.2 (remediation plans).
What the assessor is actually evaluating
The assessor will check for:
Active monitoring mechanisms: You should have tools or processes that check control status regularly. Examples include automated compliance scanning, firewall rule audits, access control audits, or log file reviews.
Monitoring frequency and evidence: The assessor will ask “How often do you monitor?” and “Show me the monitoring results from the past 30 days.” They want to see that monitoring is active and generating results.
Response to monitoring findings: If monitoring detects a control failure (e.g., a firewall rule changed, an access control violation, or a configuration drift), there should be a documented response. The assessor will ask how you handle alerts and whether you have records of actions taken.
What a realistic SSP definition looks like
The organization monitors security controls on an ongoing basis through automated tools and periodic manual reviews. Critical controls are monitored continuously. Monitoring results are reviewed daily by IT staff and monthly by leadership. Any detected failures or deviations are documented and remediated within 24 hours.
Automated monitoring: SIEM tool monitors firewall rules, access control logs, and authentication events in real-time. Dashboards are reviewed daily. Periodic reviews: IT manager performs monthly manual reviews of password policies, encryption configurations, and system logs. Results are documented in a checklist. Alerting: Critical control failures trigger automated alerts to IT staff. Non-critical findings are batched into monthly reports. Response: Any detected failure is logged in a ticket system with immediate investigation and remediation.
How to present your evidence
- Monitoring policy document (which controls, frequency, tools, responsible roles)
- Monitoring tools and configurations (SIEM dashboards, compliance scanner screenshots)
- Monitoring logs and results from the past 30-90 days
- Alert records for any detected control failures or deviations
- Response documentation (tickets or log entries showing investigation and remediation)
Common failures
No documented monitoring process. Controls exist, but you have no process for checking them. Assessors will ask "How do you know your controls are working?" and you cannot provide an answer.
Monitoring tools exist but are not actively used. You have a SIEM or scanner, but you do not review the data regularly. Logs are not being analyzed.
Monitoring is infrequent or inconsistent. Checks happen sporadically. A month passes with no monitoring activity, then you check once and nothing is seen for another month.
Monitoring alerts are ignored. The SIEM detects a control failure, but the alert goes unread. There is no documented response or remediation.
Continuous or near-continuous monitoring: dashboards reviewed daily, alerts acted on within hours. A balanced mix of automated and manual monitoring, both documented with evidence.
If you use an MSP/MSSP
If your MSP monitors controls on your behalf, request real-time access to monitoring dashboards or weekly summary reports. Ensure the monitoring scope covers all your critical controls. Ask how often alerts are reviewed and what the response time is. You are responsible for ensuring adequate monitoring is in place, even if an MSP performs the work.
Short, practical breakdowns of what assessors actually ask and how to answer. No compliance jargon, no sales pitch. Subscribe free on Substack.
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
Q&A: What the assessor asks
This guide is for reference only and does not replace official CMMC documentation or professional compliance advice.