Which of the following emphasizes the importance of continuous monitoring by requiring agencies to conduct control assessments at a frequency appropriate to risk but no less than annually? Response:

OMB Memorandum M-11-33 focused on transitioning to a Continuous Monitoring strategy, but FISMA itself established the underlying requirement.

The Federal Information Security Management Act (FISMA) of 2002 mandates that federal agencies develop, document, and implement agency-wide information security programs, including continuous monitoring and control assessments at a frequency appropriate to risk, but no less than annually. This requirement solidified the importance of ongoing security oversight.

The Clinger-Cohen Act (1996) primarily focused on improving the way federal agencies acquire, use, and manage information technology, preceding the specific security mandates of FISMA.

OMB Circular A-130, Appendix III (1997) provided initial guidance for federal information security but was superseded and enhanced by FISMA's more prescriptive requirements for continuous monitoring.