Which statement describes the continuous monitoring outcome?

• A. A static annual report is produced.
• B. No monitoring strategy is required.
• C. A quarterly update of threat intelligence feeds.
• D. A continuous monitoring strategy for the system that reflects the organizational risk management strategy is developed.

Answer: (D)

Continuous monitoring is about maintaining an ongoing, integrated view of the system’s risk posture, with data and alerts feeding into decisions that reflect how the organization manages risk. The best option describes developing a continuous monitoring strategy for the system that mirrors the organizational risk management strategy. This treats monitoring as a living process—continuously collecting and analyzing security information and adjusting controls as risk changes—rather than relying on static reports or infrequent updates. A static annual report is not continuous, and saying no monitoring strategy is required contradicts the ongoing nature of risk management. While a quarterly threat intel update can be part of the picture, it alone does not establish the sustained, aligned approach that a continuous monitoring strategy provides.