Which artifacts indicate the system's ability to operate securely over time?

• A. Monitoring results, updated SSP, SAR updates, and POA&M status showing remediation and ongoing compliance.
• B. Only monitoring results
• C. Only an initial SSP
• D. Only a final SAR

Answer: (A)

Continuous monitoring and ongoing authorization are shown by artifacts that stay current as the system evolves. Monitoring results demonstrate how the security controls perform in the live environment on an ongoing basis. An updated System Security Plan keeps the system description and control implementations accurate over time. SAR updates capture the latest findings from periodic assessments, reflecting changes in risk posture. POA&M status provides visibility into remediation actions and ongoing compliance efforts. Together, these artifacts prove the system can operate securely over time and remain authorized, rather than just reflecting a one-time snapshot. Relying on only monitoring results misses governance and remediation context; an initial SSP doesn’t show changes after deployment; a final SAR implies completion rather than ongoing assessment.