How does RMF address continuous improvement?

• A. Through isolated quarterly reviews.
• B. Through ongoing monitoring, remediation, updating controls and documentation.
• C. By adding more controls yearly.
• D. By replacing system entirely each year.

Answer: (B)

Continuous improvement in RMF happens through ongoing monitoring and a continual cycle of remediation and updates to both controls and the documentation that supports them. After controls are put in place and the system is authorized, the organization continuously collects evidence of how those controls perform, tracks changes in the system and in the threat landscape, and uses that information to address any weaknesses. When gaps are found, remediation efforts are carried out, and the security controls themselves, along with supporting documents like the System Security Plan and the Plan of Actions and Milestones, are updated to reflect the new reality. This creates a feedback loop that keeps the security posture current as technologies, missions, and threats evolve, rather than relying on isolated reviews, yearly additions, or full system replacements.