Which outcome describes ongoing authorizations using the results of continuous monitoring activities and communicating changes in risk determination and acceptance decisions?

• A. Authorizing officials conduct ongoing authorizations using the results of continuous monitoring activities and communicate changes in risk determination and acceptance decisions.
• B. The output of continuous monitoring activities is analyzed and responded to appropriately.
• C. A process is in place to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• D. Risk management documents are updated based on continuous monitoring activities.

Answer: (A)

The main idea here is ongoing authorization driven by continuous monitoring and the need to communicate changes in risk determinations and acceptance decisions. In RMF, once an authorization is granted, the system must be continually assessed. The authorizing official uses the results from continuous monitoring to re-evaluate the risk posture and, when necessary, adjust risk determinations and acceptance decisions. They then communicate those changes to stakeholders to keep everyone aligned on the current risk status and authorization stance.

That’s why this option is the best fit: it explicitly ties ongoing authorizations to using continuous monitoring outputs and to communicating any changes in how risk is determined and whether it is acceptable to operate. The other choices describe important activities—analyzing monitoring outputs, reporting posture to leadership, or updating risk documents—but they don’t capture the full duty of performing ongoing authorizations and formally communicating risk decisions based on continuous monitoring.