RMF continuous monitoring: what is its purpose?

• A. Continuous monitoring is optional and not used in RMF.
• B. Continuous monitoring is part of RMF to maintain ongoing assessment of security controls after Authorization.
• C. Continuous monitoring replaces the initial authorization.
• D. Continuous monitoring refers to continuous data backups only.

Answer: (B)

Continuous monitoring in RMF is about keeping a real-time handle on the system’s security posture by continually assessing security controls after authorization. The idea is to track changes, verify controls remain effective, collect ongoing evidence, and respond to new vulnerabilities or risks so the authorization decision stays valid over time. That’s why this purpose is best: it explicitly describes an ongoing process that continues after Authorization to Operate and supports maintaining an acceptable risk level. It’s not about replacing the initial authorization, not optional, and not limited to data backups.