Which outcome establishes an organization-wide approach to monitoring control effectiveness?

• A. A prioritization of organizational systems with the same impact level is conducted.
• B. The authorization boundary is determined.
• C. Missions, business functions identified.
• D. An organization-wide strategy for monitoring control effectiveness is developed and implemented.

Answer: (D)

In RMF, ongoing, organization-wide monitoring of controls is driven by having a formal plan that applies across the entire organization. The best outcome is developing and implementing an organization-wide strategy for monitoring control effectiveness. This means creating a formal plan that specifies what controls to monitor, how often they are tested, what methods and data sources are used, who is responsible, and how results are reported and acted upon across all systems. With such a strategy, monitoring becomes consistent and repeatable rather than piecemeal or system-specific. It provides standard metrics, supports timely identification of gaps, and directs remediation efforts, giving management and the authorization official confidence that security controls stay effective over time.

Other options don’t establish that broad, cohesive framework: prioritizing systems by impact level is more about resource allocation and risk emphasis rather than a unified monitoring approach; determining the authorization boundary defines the scope for authorization, not how controls will be monitored; identifying missions and business functions sets context but does not establish how control effectiveness will be monitored across the organization.