Which outcome states that a system disposal strategy is developed and implemented, as needed?

• A. A process is in place to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• B. The output of continuous monitoring activities is analyzed and responded to appropriately.
• C. Risk management documents are updated based on continuous monitoring activities.
• D. A system disposal strategy is developed and implemented, as needed.

Answer: (B)

Continuous monitoring is about ongoing observation of a system’s security state and turning what you observe into action. The essential outcome is to analyze the results of monitoring activities and respond appropriately. This means looking at vulnerabilities, incidents, or changes in risk, determining what they mean for the system’s security posture, and taking remediation, adjustment, or mitigation steps as needed. That ability to translate monitoring data into concrete actions keeps the system protected and compliant over time.

While other activities like reporting posture to leadership, updating risk documents, or planning disposal are important parts of the overall lifecycle, they are not the immediate, primary result of continuous monitoring. The core value of continuous monitoring is producing actionable responses from the monitoring outputs.