I know about this because I started my career helping an agency achieve a CAESARS-like program, which was based more on NIST's Risk Management Framework (RMF) -

I know about this because I started my career helping an agency achieve a CAESARS-like program, which was based more on NIST's Risk Management Framework (RMF) - The basis of it is to define your systems, their Confidentiality/Integrity/Availability impact levels, a chain of management who has authority over the systems, security controls to protect the systems, continual evaluation of the security controls, and expedient management of risks associated with failure to implement security controls properly. (http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800...) The best security operations people I've worked with are the ones who are very curious. They scour over the configuration management, patch management, and defense systems - always checking to see if they do the things they're actually meant to do. Alerts on security events are very useful. Having multiple tools to cross-reference pays off when the results are different and it reveals an underlying problem that nobody expected.