Which element does a Monitoring Plan specify in RMF?

• A. The plan defines boundary documents and interfaces.
• B. The plan defines the continuous monitoring activities, metrics, frequencies, and reporting responsibilities.
• C. The plan specifies incident response roles and playbooks.
• D. The plan details data retention and disposal schedules.

Answer: (B)

Continuous monitoring is about tracking the ongoing effectiveness of security controls. In RMF, the Monitoring Plan is the place that spells out how this monitoring will be done. It specifies the activities you’ll perform to keep an eye on controls, the metrics you’ll collect to gauge performance, how often you’ll collect and review that data, and who is responsible for reporting the results. This structure ensures you have up-to-date evidence of control effectiveness and a clear process to act when issues or threshold violations arise.

Other elements belong to different plans or policies. Defining boundary documents and interfaces relates to system boundaries and how components connect, rather than ongoing control monitoring. Incident response roles and playbooks belong in an incident response plan, detailing how to detect, respond to, and recover from incidents. Data retention and disposal schedules sit with data governance and lifecycle policies, focused on how long data is kept and how it’s disposed of.