feat: add NIST SP 800-137 Information Security Continuous Monitoring skill

[sjackson0109]

NIST SP 800-137 — Information Security Continuous Monitoring (ISCM)

Source Publication: NIST Special Publication 800-137, September 2011
CSRC URL: https://csrc.nist.gov/publications/detail/sp/800-137/final

This pull request adds a complete Claude skill plugin for NIST SP 800-137, supporting ISSOs, ISOs, CIOs, SAISOs, and Authorizing Officials designing, implementing, and managing Information Security Continuous Monitoring programmes for federal information systems and organisations.

---

Files Added

plugins/nist-sp-800-137/
  .claude-plugin/plugin.json
  skills/nist-sp-800-137/
    SKILL.md
    references/
      iscm-process.md
      monitoring-strategy.md
      metrics-reporting.md

---

Framework Coverage

ISCM Definition: Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organisational risk management decisions. Three requirements: situational awareness, visibility, and traceability.

Three-Tier Architecture: Tier 1 (Organisation — strategy, risk tolerance, CIO/SAISO), Tier 2 (Mission/Business Process — common controls, mission alignment), Tier 3 (Information System — ISO/ISSO, system-specific monitoring). Information flows upward; risk guidance flows downward.

Six-Step ISCM Process: Define ISCM strategy, Establish programme, Implement programme, Analyse and report findings, Respond to findings, Review and update strategy. Each step includes inputs, tasks, and outputs.

Monitoring Frequencies: Continuous/automated, daily, weekly, monthly, quarterly, annual. Frequency selection criteria: information volatility, adversary speed of exploitation, CIA impact, automation feasibility.

Security Metrics Catalogue: 15 defined metrics with full attribute sets covering patch compliance (critical and high), AV currency, configuration compliance, unauthorised software detection, inactive accounts, MFA coverage, audit log coverage, vulnerability scan coverage, ATO status, POA&M health. Each metric includes measurement formula, data source, threshold, and escalation rules.

Control Automation Tiers: Controls classified as Tier A (highly amenable to continuous/daily automation — SI-2, SI-3, CM-6, CM-7, etc.), Tier B (semi-automated periodic — AC-2, RA-5, SC-28, etc.), Tier C (primarily manual — AT-2, CA-2, CP-4, etc.).

SCAP Integration: CVE, CCE, CPE, CVSS, OVAL, XCCDF components explained. ARF (Asset Reporting Format) for aggregation. SCAP-validated tool requirements. Automation capability levels (fully automated, semi-automated, fully manual).

Roles and Responsibilities: CIO, SAISO, Risk Executive Function, Authorizing Official, Information System Owner, ISSO, Common Control Provider — with specific ISCM responsibilities per role.

RMF Integration: All seven RMF Step 6 Monitor tasks mapped to ISCM process steps. Ongoing authorisation model explained with AO threshold-based decision framework.

DHS CDM Programme: Four CDM capability layers mapped to ISCM tiers. Agency and Federal Dashboard feeds.

ISCM Programme Maturity: Five-level scale from Ad hoc through Optimised.

---

Reference Files

references/iscm-process.md — Six-step ISCM process with per-step inputs, tasks, and outputs. All 24 ISCM tasks with step-by-step detail. Tier 3/2/1 and AO reporting task breakdown. Remediation timeframe table (Critical 15 days through Low 180 days). Event-driven and periodic triggers for Step 6 review. Complete ISCM programme checklist covering all six steps.

references/monitoring-strategy.md — ISCM strategy document structure with 10 required sections. Monitoring frequency assignment table template with SP 800-53 control examples. Control automation tiers (A/B/C) with representative controls per tier. Programme establishment procedures: tool selection criteria, baseline procedures (configuration/software/patch), data repository architecture. ISCM maturity model (Levels 1-5). CDM programme layer mapping.

references/metrics-reporting.md — Metric attribute set (11-field standard format). Full 15-metric ISCM catalogue with measurements, frequencies, thresholds, and escalation rules. Complete Tier 3 system-level report template with all sections. Tier 2 mission/business process aggregated report template. Tier 1 organisation-level dashboard template. AO threshold-exceeded notification template. POA&M format with all required fields.

---

Integration Points

• SP 800-37 Rev 2 RMF Step 6: ISCM implements all seven Monitor tasks (M-1 through M-7)
• SP 800-53 Rev 5: ISCM metrics map to SP 800-53 control families (all metric IDs reference control IDs)
• SP 800-53A Rev 5: ongoing assessments supplement ISCM automated monitoring data
• SP 800-30 Rev 1: risk determination scales used for finding severity classification in reporting
• SP 800-39: three-tier risk management hierarchy is the structural basis for ISCM architecture

---

Tests

python -m pytest tests/test_plugin_structure.py -v -k "nist-sp-800-137"

tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_exists[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_is_valid[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_required_fields[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_version_semver[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_exists[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_has_one_skill_folder[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_exists[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_not_empty[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_no_files_outside_skill_folder[nist-sp-800-137] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_references_are_markdown[nist-sp-800-137] PASSED

10 passed, 95 deselected in 0.07s