Which outcome indicates developing and implementing a disposal strategy when appropriate?

• A. The output of continuous monitoring activities is analyzed and responded to appropriately.
• B. A system disposal strategy is developed and implemented, as needed.
• C. A process to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• D. Risk management documents are updated based on continuous monitoring activities.

Answer: (A)

Developing and implementing a disposal strategy when appropriate is about planning how and when to retire and securely destroy system components and data. The best outcome here is having a formal system disposal strategy created and put into action as needed, ensuring that assets are decommissioned safely, data is sanitized or destroyed properly, and any residual risks are addressed before disposal. This aligns with asset lifecycle management in RMF, where secure disposal protects information, supports compliance, and prevents data leakage.

The other outcomes describe ongoing monitoring, governance reporting, and updating risk documentation based on monitoring results, which are important for ongoing risk management but do not focus on the disposal process itself.