Which outcome describes ongoing authorization activities?

• A. A process is in place to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• B. Risk management documents are updated based on continuous monitoring activities.
• C. Authorizing officials conduct ongoing authorizations using the results of continuous monitoring activities and communicate changes in risk determination and acceptance decisions.
• D. A system disposal strategy is developed and implemented, as needed.

Answer: (C)

Ongoing authorization means treating authorization as a living process where the authorizing official regularly uses the results of continuous monitoring to reassess and adjust the authorization decision. As new security and risk information flows in, the official updates the risk determination and any risk acceptance decisions and communicates those changes. This captures the core idea that authorization isn’t a one-time event but an evolving process guided by real-time monitoring data.

Other choices describe important but different activities: reporting posture to leaders is about governance and visibility, updating risk management documents is about keeping documentation in line with current data, and developing a disposal strategy is about lifecycle planning. None of these, by themselves, embody the ongoing, decision-making act of authorizing based on continuous monitoring results.