What type of outputs are produced by continuous monitoring activities in RMF?

• A. Ongoing status reports showing remediation progress and up-to-date compliance
• B. Static annual reports only
• C. No outputs
• D. Only during annual reauthorization

Answer: (B)

Continuous monitoring in RMF is about keeping a live picture of the system’s security posture. The outputs are ongoing status reports, dashboards, and artifacts that continuously show how controls are performing, what remediation work has been completed, and what gaps or risks remain. This steady stream of updates lets stakeholders track progress, adjust defenses in real time, and make informed reauthorization decisions as conditions change.

Static annual reports only provide a single snapshot and can miss new threats or changes in the system between updates, so they don’t reflect the current posture. Outputs aren’t absent, and they aren’t limited to annual reauthorization; they’re produced continually to maintain an up-to-date view of security and risk.