When does monitoring security controls take place? Response:

Before initial system certification, controls are assessed for effectiveness, but continuous monitoring is typically a post-certification or post-authorization activity.

Monitoring security controls is an essential part of the ongoing authorization process, which begins after the initial system security authorization (or accreditation) is granted. This continuous activity ensures that controls remain effective and that the system's risk posture is managed throughout its lifecycle.

While assessment happens before accreditation, ongoing monitoring is primarily an activity that occurs after the initial security accreditation to ensure continued effectiveness, making 'before and after' misleading for continuous monitoring.

During the system design phase, security requirements are defined and controls are designed, but the actual monitoring of implemented controls occurs in later lifecycle phases.