Which RMF step governs continuous monitoring?

• A. Assess
• B. Monitor
• C. Plan
• D. Authorize

Answer: (B)

Continuous monitoring is the ongoing activity that keeps a system’s security posture up to date after it has been authorized. In RMF, the step that governs this ongoing effort is the Monitor step. It involves continuously assessing the effectiveness of security controls, tracking changes, managing vulnerabilities, handling incidents, and updating risk decisions as needed to ensure the system remains secure and authorized to operate.

Assess is the phase focused on evaluating controls to determine if they are properly implemented and effective before authorization. Authorize is the decision to allow operation based on that evaluation. Plan isn’t one of the standard RMF steps, though planning happens earlier in the lifecycle.