Which statement describes ongoing authorizations using the monitoring results and communicating changes in risk decisions and acceptance decisions?

• A. Risk management documents are updated based on continuous monitoring activities.
• B. The output of continuous monitoring activities is analyzed and responded to appropriately.
• C. Authorizing officials conduct ongoing authorizations using the results of continuous monitoring activities and communicate changes in risk determination and acceptance decisions.
• D. A system disposal strategy is developed and implemented, as needed.

Answer: (C)

Ongoing authorization rests on using continuous monitoring results to continuously reassess risk and keep authorization status up to date. The Authorizing Official uses those monitoring outputs to re-evaluate the system’s risk posture and, when needed, adjust risk determinations and acceptance decisions. Crucially, this approach includes communicating any changes in risk determination and acceptance decisions to the right stakeholders, so everyone understands the current authorization status.

The other ideas touch on related parts of the process—such as updating documents with monitoring findings or analyzing and reacting to monitoring outputs—but they don’t capture the full action of the Authorizing Official conducting ongoing authorizations and explicitly communicating shifts in risk and acceptance decisions. System disposal strategy is unrelated to ongoing authorization.