Which statement best describes the outcome of ongoing risk response activities?

• A. The output of continuous monitoring activities is analyzed and responded to appropriately.
• B. A system disposal strategy is developed and implemented, as needed.
• C. A process is in place to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• D. Risk management documents are updated based on continuous monitoring activities.

Answer: (A)

Ongoing risk response is driven by continuous monitoring that produces real-time data on risk and control effectiveness. The essential outcome is that these monitoring outputs are analyzed and acted upon, so appropriate responses are applied to mitigate or manage risk as conditions change. This keeps the risk level in an acceptable range and maintains an adaptive security posture. While disposal strategies, governance reporting, or updating risk documents can be relevant in broader risk management activities, they do not describe the immediate result of ongoing risk response as precisely as analyzing monitoring results and taking corrective actions.