Which outcome corresponds to updates to the authorization package based on continuous monitoring activities?

• A. A process is in place to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• B. The output of continuous monitoring activities is analyzed and responded to appropriately.
• C. A system disposal strategy is developed and implemented, as needed.
• D. Risk management documents are updated based on continuous monitoring activities.

Answer: (D)

Continuous monitoring provides ongoing insight into how well security controls are functioning and what risk remains. The results of that monitoring—changes in control effectiveness, newly discovered vulnerabilities, environmental changes, and updated risk levels—need to be reflected in the formal documentation that supports authorization. Updating risk management documents ensures the authorization package stays current and accurately represents the system’s security posture for the Authorizing Official. That alignment between observed risk and the official package is what keeps the ongoing authorization valid.

The other outcomes describe important activities (reporting posture to leadership, analyzing and responding to monitoring results, or planning disposal), but they do not specifically capture the act of refreshing the authorization package itself with up-to-date risk information.