For years government agencies have complained that federal government security requirements were nothing but paper drills that did little to improve security. Now there is renewed emphasis on automation and continuous monitoring that would both provide a better and more current picture of compliance efforts and improve security. But just what does continuous monitoring mean and how can it be implemented cost effectively?