Which outcome describes ongoing authorizations and communication of risk changes by the authorizing official?

• A. Risk management documents are updated based on continuous monitoring activities.
• B. The output of continuous monitoring activities is analyzed and responded to appropriately.
• C. Authorizing officials conduct ongoing authorizations using the results of continuous monitoring activities and communicate changes in risk determination and acceptance decisions.
• D. A system disposal strategy is developed and implemented, as needed.

Answer: (C)

Ongoing authorization is about the authorizing official continuously reassessing risk and keeping stakeholders informed as conditions change. This option describes that process: the authorizing official uses the results of continuous monitoring to perform ongoing authorizations and to communicate any changes in risk determinations and in risk acceptance decisions. It captures both the act of reauthorizing as new risk information comes in and the essential step of informing appropriate parties about how risk posture has evolved.

The other ideas touch parts of the monitoring cycle—updating documents, analyzing outputs, or planning disposal—but they don’t describe the authorizing official actively reauthorizing on an ongoing basis and communicating those risk changes.