Which statement describes how to respond to the results of continuous monitoring to address risk?

• A. A system disposal strategy is developed and implemented, as needed.
• B. The output of continuous monitoring activities is analyzed and responded to appropriately.
• C. A process to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• D. Risk management documents are updated based on continuous monitoring activities.

Answer: (D)

Continuous monitoring is about keeping an up-to-date view of the system’s risk as conditions change. The results from monitoring feed into the risk management process so decisions stay current and actions to reduce risk are tracked. Updating risk management documents—such as the Security Plan, the risk assessment, the Plan of Actions and Milestones, and the risk register—ensures that new vulnerabilities, control gaps, or changes in the system are reflected, and that remediation efforts and authorization decisions stay valid. This creates a closed loop where monitoring results directly influence how risk is treated moving forward.

While analyzing monitoring outputs and communicating findings are important parts of the process, they don’t by themselves ensure risk is addressed. Updating the risk artifacts provides the formal record and decision basis that drives remediation, control adjustments, and ongoing authorization. Options like developing a disposal strategy or simply reporting posture to leadership are situational or governance actions, but they don’t consistently implement the ongoing risk treatment that continuous monitoring is intended to support.