Establishing the programme means determining metrics, frequencies and a technical:

1. Setting up the programme is more than choosing measures. 2. The tooling that collects them has to be designed too. 3. Establishing the programme determines metrics, monitoring frequencies, assessment frequencies and a technical architecture. 4. So the answer is architecture. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_