Which task covers Ongoing Assessments at the monitoring level?

• A. Ongoing Authorization
• B. System and Environment Changes
• C. Ongoing Assessments
• D. Security and Privacy Reporting

Answer: (C)

Continuous monitoring hinges on repeatedly checking that security controls remain effective as the system and environment evolve. The task named Ongoing Assessments captures this ongoing, repeated evaluation of controls, including collecting evidence, testing control effectiveness, tracking residual risk, and updating remediation plans. These activities provide the up-to-date understanding of the security posture that informs decisions to maintain or adjust the authorization to operate. Other tasks touch related aspects—maintaining authorization, handling changes, or reporting on security and privacy—but they do not represent the continuous assessment process itself.