How does RMF handle changes to a system after authorization?

• A. Changes are ignored unless major.
• B. Changes always require reauthorization in all cases.
• C. Changes are limited to updating the SSP only.
• D. Changes may trigger updates to the authorization package and possibly a re-assessment or reauthorization.

Answer: (D)

In RMF, after a system is authorized, changes aren’t treated as automatically safe. The process relies on continuous monitoring and risk-based decision making. When something changes, you assess how it affects risk and the security posture. If the change impacts security controls or the overall risk, you update the authorization package (which includes the security plan and related authorization artifacts) and you may need a new assessment or reauthorization. If the change is minor and keeps risk within the approved boundary, you can handle it through updates to the authorization package and ongoing monitoring without a full reauthorization. This is why the best answer says changes may trigger updates to the authorization package and possibly a re-assessment or reauthorization. It isn’t appropriate to ignore changes, it isn’t always necessary to reauthorize for every minor change, and it isn’t limited to just updating the SSP.