In RMF, what is the purpose of continuous monitoring?

• A. Provide an initial security baseline only during deployment
• B. Verify that compensating controls remain effective without change
• C. Continuously assess and monitor security controls to maintain risk posture
• D. Replace the initial assessment with annual reviews

Answer: (C)

Continuous monitoring focuses on ongoing assessment and monitoring of security controls to keep the organization’s risk posture in check. It means you’re not just setting a baseline at deployment and then stopping; you continuously collect data on how well controls are working, monitor for changes in the system or threat landscape, and look for drift or new vulnerabilities. This constant vigilance lets you detect when a control no longer meets requirements or when risk increases, so you can adjust defenses, update risk assessments, and keep the authorization to operate current. In short, it provides a living view of security posture rather than a one-time snapshot.

It isn’t about providing an initial baseline only, nor about assuming compensating controls stay effective without any changes, and it isn’t a replacement for the initial assessment with annual reviews. Continuous monitoring complements periodic assessments by delivering real-time or near-real-time insight into control effectiveness.