SOL FINAL - Attachment 7 - OCIO-PRC-003 - Information Security Continuous Monitoring Strategy.pdf

Controlled Unclassified Information (CUI)

UNITED STATES

PATENT AND TRADEMARK OFFICE (USPTO)

INFORMATION SECURITY CONTINUOUS

MONITORING (ISCM) STRATEGY

July 2025

Version 1.0

ISCM Strategy i

VERSION HISTORY

Version Date Sections Affected Change Description Modified By

1.0 7/18/2025 All Created new ISCM Strategy guide to establish USPTO Continuous Monitoring priorities

Booz Allen Hamilton ii

Controlled Unclassified Information (CUI)

Approval I hereby approve the USPTO ISCM Strategy.

Timothy S. Goodwin Chief Information Security Officer Office of the Chief Information Security Officer United States Patent and Trademark Office iii

Controlled Unclassified Information (CUI)

Table of Contents

1 INTRODUCTION

1.1 PURPOSE

1.2 BACKGROUND

1.3 AUTHORITIES AND REFERENCES

2 CONTINUOUS RISK-BASED MONITORING AND SECURITY CONTROL ASSESSMENTS

2.1 AUTHORITIES AND REFERENCES

2.2 SECURITY CONTROL ASSESSMENTS

2.3 ONGOING AUTHORIZATION

3 IMPLEMENTATION OF SECURITY MONITORING TECHNOLOGIES

3.1 ADVANCED SECURITY TOOLS

3.2 ZERO-TRUST ARCHITECTURE IMPLEMENTATION

3.3 ENTERPRISE ARCHITECTURE AND INTEROPERABILITY

4 INCIDENT DETECTION AND RESPONSE ENHANCEMENT

4.1 INCIDENT DETECTION AND RESPONSE

4.2 THREAT INTELLIGENCE AND INTEGRATION

5 COMPLIANCE, AUDITING, AND REPORTING

5.1 FISMA COMPLIANCE

5.2 EXECUTIVE DASHBOARDING FOR LEADERSHIP INSIGHT

6 WORKFORCE AWARENESS AND CONTINUOUS TRAINING

6.1 CYBERSECURITY TRAINING FOR STAFF

6.2 INNOVATION IN CYBERSECURITY CULTURE

7 CONTINUOUS OPERATION AND FUTURE-PROOFING

7.1 AI-DRIVEN ANOMALY DETECTION

7.2 ENHANCING CLOUD SECURITY MONITORING

7.3 PERIODIC SECURITY PROGRAM REVIEWS

8 CONCLUSION

1 INTRODUCTION

The United States Patent and Trademark Office (USPTO) is a vital federal agency responsible for protecting intellectual property, facilitating innovation, and processing patent and trademark applications. Given the agency's role in managing sensitive legal and technological data, the USPTO will implement a robust Information Security Continuous Monitoring (ISCM) strategy aligned with federal cybersecurity mandates, such as Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology (NIST) Special Publication (SP) 800-137, Office of Management and Budget (OMB) Circular A-130, and the NIST Risk Management Framework (RMF).

This ISCM Strategy integrates security control assessments, vulnerability and compliance scanning, real-time threat monitoring, zero-trust architecture, workforce training, and federal compliance automation. By adopting proactive risk management methodologies, the USPTO will strengthen its cybersecurity posture, ensuring operational resilience while safeguarding intellectual property against evolving cyber threats.

1.1 Purpose

This strategy outlines how the USPTO will evolve its cybersecurity posture through continuous, risk-based monitoring and real-time authorization in accordance with the USPTO Information Technology (IT) Security Handbook, Department of Commerce (DOC) Enterprise Cybersecurity Policy (ECP), DOC Security and Privacy Assessment and Authorization (SPA&A) Handbook, and NIST SP 800-37, Rev. 2 requirements. The USPTO disseminates the ISCM Strategy to all government and contractor personnel through the USPTO Office of the Chief Information Officer (OCIO).

1.2 Background

Based on federal requirements and mandates, the USPTO is responsible for ensuring that all USPTO information systems meet the minimum-security requirements defined in the Federal Information Processing Standards (FIPS) Publication (PUB) 200, Minimum Security Requirements for Federal Information and Information Systems. All USPTO information systems must meet the security requirements through the use of the security and privacy controls in the NIST SP 800-53 Revision (Rev.) 5, Security and Privacy Controls for Federal Information Systems and Organizations.

NIST defines the Continuous Monitoring step of the RMF as “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.” A robust Continuous Monitoring program ensures that security and privacy controls within an information system remain effective over time and promotes the concept of near real-time risk management.

1.3 Authorities and References

This USPTO ISCM Strategy is issued under the authority of the USPTO Chief Information Officer (CIO). The OCISO Privacy and Continuous Monitoring Branch (PCMB) is responsible for managing and disseminating the USPTO ISCM Strategy. Critical federal laws, regulations, Executive Orders, policies, standards, and directives pertaining to information security include:

• E-Government Act of 2002

• The Privacy Act of 1974

• Clinger-Cohen Act of 1996

• National Technology Transfer and Advancement Act of 1996

• Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• Federal Information Security Modernization Act of 2014 (FISMA)

• Federal Financial Management Improvement Act of 1996 (FFMIA)

• Federal Acquisition Streamlining Act of 1994 (FASA)

• United States Government Accountability Office, Federal Information System Controls

Audit Manual (FISCAM)

• OMB Circulars

• OMB Memoranda

• Federal Information Processing Standards (FIPS)

• NIST Special Publications

• DOC CITRs

• DOC Contingency Planning Standard v1.1

• DOC Enterprise Cybersecurity Policy v1.1

• DOC SPA&A Handbook v1.1

• DOC Incident Response Management Standard (IRMS) v1.1

• DOC ISCM Handbook v1.1

• DOC Vulnerability Management Standard v.1.1

• USPTO Assessment and Authorization (A&A) Process Guide v2.1

• USPTO Enterprise Architecture Policy v.2.2

• USPTO Incident Response Procedures v.2.0

• USPTO IT Security Handbook v6.0

• USPTO Security Impact Analysis (SIA) Process Guide v4.0

• USPTO Vulnerability Management Policy v1.0

2 CONTINUOUS RISK-BASED MONITORING AND SECURITY

CONTROL ASSESSMENTS

This section describes the applicable authorities, references, Security Control Assessments (SCA), and ongoing authorization for continuous risk-based monitoring.

2.1 Authorities and References

The USPTO will categorize assets based on risk exposure and operational impact to ensure critical systems receive enhanced protection and apply the appropriate security measures. To maintain comprehensive security coverage, the USPTO will continuously review system boundaries, asset inventories, vulnerability and compliance scan results, and scan quality. The USPTO manages vulnerabilities in accordance with the established DOC and Bureau requirements. These practices ensure security teams can promptly identify and remediate vulnerabilities before exploitation occurs. For additional risk categorization and prioritization information and procedures, refer to the DOC ISCM Handbook, the DOC Vulnerability Management Standard, and the USPTO Vulnerability Management Policy.

2.2 Security Control Assessments

The USPTO will continue to conduct and enhance an SCA framework that continuously evaluates the effectiveness of NIST SP 800-53, Rev. 5 security controls across federal information systems.

Periodic assessments validate whether security controls remain effective against evolving threats.

The USPTO should integrate automated security validation tools to reduce reliance on manual control evaluations, enhancing both accuracy and efficiency. The USPTO will assess all security and privacy controls selected for the information system during the initial authorization and a subset of the security or privacy controls during continuous monitoring on an ongoing basis. For additional security control assessment information and procedures, refer to the USPTO A&A Process Guide.

2.3 Ongoing Authorization

The USPTO will adopt an Ongoing Authorization (OA) framework, ensuring that security assessments are conducted in real time rather than in traditional static authorization cycles. This approach, as recommended in NIST SP 800-37, Rev. 2 (Risk Management Framework for Information Systems and Organizations), enhances the USPTO’s ability to maintain compliance while adapting to emerging cyber risks. The USPTO will conduct cyber hygiene activities to ensure the data inputs to ongoing authorization decisions, such as accuracy of system asset inventories and vulnerability and compliance scans, are up-to-date, accurate, and continuously operating as intended. For additional ongoing authorization information and procedures, refer to the DOC ISCM Handbook and the DOC SPA&A Handbook.

3 IMPLEMENTATION OF SECURITY MONITORING

TECHNOLOGIES

This section discusses the need for advanced security tools, zero-trust architecture implementation, and an enterprise architecture.

3.1 Advanced Security Tools

To ensure real-time visibility across enterprise environments, the USPTO will deploy Endpoint Detection and Response (EDR), Network Traffic Analysis (NTA), firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and Security Information and Event Management (SIEM) platforms. These technologies provide actionable security intelligence, allowing the USPTO to detect cyber threats before they escalate into full-blown incidents.

3.2 Zero-Trust Architecture Implementation

The continued transition to zero-trust security principles ensures the USPTO enforces continuous access verification and least-privilege access controls. The USPTO should integrate Identity and

Access Management (IAM) solutions, multi-factor authentication (MFA), and behavioral analytics to prevent unauthorized access.

3.3 Enterprise Architecture and Interoperability

The USPTO will implement an Enterprise Architecture that improves interoperability, reduces complexity, and promotes the reuse of existing capabilities. The USPTO Enterprise Architecture will provide guidance and requirements for development and maintenance of USPTO product components and services. For additional Enterprise Architecture information and procedures, refer to the DOC Enterprise Cybersecurity Policy and the USPTO Enterprise Architecture Policy.

4 INCIDENT DETECTION AND RESPONSE ENHANCEMENT

This section discusses the need for incident detection and response, as well as threat intelligence and integration.

4.1 Incident Detection and Response

The USPTO will continue to implement and optimize procedures for detecting, reporting, and responding to security incidents to ensure the integrity, confidentiality, and availability of its data and information systems. Incident detection and response activities should be tightly integrated and coordinated across the USPTO’s security and product teams. For additional incident detection and response information and procedures, refer to the USPTO IT Security Handbook, USPTO Incident Response Procedures, and the DOC IRMS.

4.2 Threat Intelligence and Integration

The USPTO Threat Intelligence and Risk Analysis Branch (TRAB) will conduct threat identification, detection, awareness, and training activities and implement a cross-organization information-sharing capability for threat intelligence. The USPTO will collaborate with sources such as the DOC, Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), and Federal Computer Incident Response Team (FedCIRT) to access real-time federal cyber threat intelligence. The USPTO will establish an automated threat intelligence platform that enhances the USPTO’s ability to analyze and respond to advanced cyber threats. The USPTO will establish an insider threat program to enable recognizing and reporting potential indicators of insider threat and communicate applicable threats to the appropriate channels. For additional threat intelligence information and procedures, refer to the USPTO IT Security Handbook and USPTO Incident Response Procedures.

5 COMPLIANCE, AUDITING, AND REPORTING

This section provides information on FISMA compliance and executive dashboarding for leadership insight.

5.1 FISMA Compliance

The USPTO will leverage compliance validation tools to streamline FISMA audits, OMB cybersecurity scorecard reviews, and Government Accountability Office (GAO) assessments.

Automating security control verification improves reporting accuracy and ensures the USPTO meets regulatory deadlines. The USPTO will use the governance, risk, and compliance (GRC) tool to document and support each FISMA system’s Authorization to Operate (ATO).

5.2 Executive Dashboarding for Leadership Insight

The USPTO will develop and maintain interactive cybersecurity dashboards to provide real-time analytics on security incidents, vulnerabilities, and compliance posture. These tools ensure the USPTO’s leadership maintains visibility over key security metrics and a current view of organizational risk.

6 WORKFORCE AWARENESS AND CONTINUOUS TRAINING

This section discusses the need for cybersecurity training for USPTO staff and the need for a culture of innovative cybersecurity.

6.1 Cybersecurity Training for Staff

USPTO employees play a crucial role in maintaining the agency’s cybersecurity posture. The USPTO will implement annual cybersecurity certification programs, phishing awareness exercises, insider threat detection training, and data protection workshops to ensure that personnel remain well-informed on evolving cyber risks. For additional cybersecurity awareness training information and procedures, refer to the USPTO Security Awareness and Training Procedures.

6.2 Innovation in Cybersecurity Culture

The USPTO will encourage cybersecurity research by collaborating with security subject matter experts (SME) such as industry leaders, tool vendors, and Defense Information Systems Agency (DISA), CISA, Center for Internet Security (CIS), Open Web Application Security Project (OWASP), NIST, and OMB guidance and best practices SMEs to leverage new methodologies for securing intellectual property data.

7 CONTINUOUS OPERATION AND FUTURE-PROOFING

This section provides information on Artificial Intelligence (AI)-driven anomaly detection and cloud security monitoring enhancements.

7.1 AI-Driven Anomaly Detection

The USPTO will integrate OCIO approved AI-driven behavioral analytics into its security systems (i.e., SIEM, fraud detection). Approved AI models, trained on historical system use and network traffic patterns, can identify anomalies and help detect security issues and events.

7.2 Enhancing Cloud Security Monitoring

The USPTO increasingly relies on cloud platforms to streamline patent processing. Deploying automated cloud security validation tools promotes continuous compliance with Federal Risk and Authorization Management Program (FedRAMP) security standards. For USPTO-hosted cloud systems, the USPTO will ensure Cloud Service Offering (CSO) infrastructure is continuously scanned for vulnerabilities and unsecure configurations. For FedRAMP systems, the USPTO will monitor vulnerabilities and Plans of Actions and Milestones (POA&M) on the

CSO and ensure that the Cloud Service Provider (CSP) continuous monitoring activities are conducted commensurate with NIST, DOC, and USPTO requirements. For additional cloud security information and procedures, refer to the USPTO Cloud Security Authorization Guide.

7.3 Periodic Security Program Reviews

The USPTO will conduct periodic ISCM program assessments, integrating feedback from federal auditors, industry security experts, and policy advisors to refine cybersecurity strategies.

8 CONCLUSION

The USPTO’s ISCM Strategy ensures that SCAs, ongoing authorization mechanisms, zero-trust security, workforce training, and continuous compliance automation are integrated into the USPTO’s cybersecurity framework. By aligning ISCM initiatives with FISMA, NIST guidelines, OMB directives, and federal cyber threat intelligence programs, the USPTO enhances its resilience against sophisticated cyber threats while safeguarding intellectual property integrity.

8 Conclusion