How often must configuration monitoring be performed according to Requirement R2?

Configuration monitoring must be performed continuously as per Requirement R2 of the NERC CIP v7 standards. This requirement emphasizes the need for constant oversight of systems to ensure that any changes, unauthorized alterations, or anomalies in the configurations are detected immediately. Continuous monitoring helps to enhance the security posture of the critical infrastructure by allowing for real-time assessment and quicker response to potential threats or compliance issues. This proactive approach mitigates risks effectively and supports the overall availability and security of the energy management system.

The other options, such as annually, quarterly, and every two years, do not align with the continuous nature of the monitoring requirement, as they propose periodic assessments that could leave the system vulnerable to undetected changes or security breaches during the intervals between evaluations. Continuous monitoring ensures that any deviations from the established security baselines can be identified and addressed without delay.