What drives the continuous monitoring strategy?

1. Strategy is set at the top rather than by each system. 2. The organisation level decides the tolerances. 3. Tier 1 governance, risk management goals and organizational risk tolerance drive the ISCM strategy. 4. So the answer is Tier 1 governance. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_