Which outcome indicates that risk management documents are updated based on continuous monitoring activities?

• A. The output of continuous monitoring activities is analyzed and responded to appropriately.
• B. A process to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• C. Authorizing officials conduct ongoing authorizations using the results of continuous monitoring activities and communicate changes in risk determination and acceptance decisions.
• D. Risk management documents are updated based on continuous monitoring activities.

Answer: (D)

Continuous monitoring feeds current findings into the risk management paperwork, so the documentation stays aligned with the actual security posture. When monitoring shows changes in control effectiveness or residual risk, updating the risk management documents—such as the security plan, risk assessment, and POA&M—ensures that authorization decisions and risk acceptance reflect the latest information. This explicit updating is the concrete outcome that ties ongoing monitoring to governance and accountability. Other activities like analyzing monitoring outputs, reporting posture to leadership, or conducting ongoing authorizations happen as part of the process, but the key result described here is that the risk management documents are refreshed based on what continuous monitoring reveals.