What determines the metrics and the frequency they are monitored at?

1. Frequency is not chosen for its own sake. 2. It follows how much risk the organisation will carry. 3. Metrics and their monitoring frequency are determined by requirements to stay within organizational risk tolerances. 4. So the answer is risk tolerances. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_