In RMF, how should assessments be refreshed for a stable system?

• A. Only after a major incident
• B. On a defined schedule (e.g., annually) or upon significant changes; continuous monitoring may require more frequent checks.
• C. Continuously without a defined schedule
• D. Never; once approved is enough

Answer: (B)

Refreshing assessments in RMF should follow a defined schedule and reflect significant changes, with continuous monitoring capable of triggering more frequent checks. This approach keeps the security posture accurate over time: you have regular, planned reassessments (for example annually), and you also re-evaluate when there are meaningful changes to the system, its environment, or threat landscape. Continuous monitoring supports this by signaling when conditions warrant a more frequent review, rather than leaving assessments to a one-time event.

Why this fits best: it prevents gaps that could occur if you wait for a major incident to trigger reassessment, and it avoids relying on an indefinite, never-ending approval. It also recognizes that stability doesn’t mean no risk or no need to update—new vulnerabilities, patches, or configuration changes still require timely reevaluation.

The other approaches fall short because waiting for incidents misses proactive risk management, never re-evaluating ignores evolving threats and changes, and relying on continuous activity without any schedule loses the planned cadence that RMF uses for ongoing authorization.