nerdexam
Isaca

CISM · Question #38

The PRIMARY purpose for continuous monitoring of security controls is to ensure:

The correct answer is B. effectiveness of controls. The primary purpose of continuous monitoring of security controls is to ensure their ongoing effectiveness in protecting organizational assets against threats.

Submitted by yuriko_h· Apr 18, 2026Information Security Program Development and Management

Question

The PRIMARY purpose for continuous monitoring of security controls is to ensure:

Options

  • Aalignment with compliance requirements.
  • Beffectiveness of controls.
  • Ccontrol gaps are minimized.
  • Dsystem availability.

How the community answered

(28 responses)
  • B
    89% (25)
  • C
    7% (2)
  • D
    4% (1)

Why each option

The primary purpose of continuous monitoring of security controls is to ensure their ongoing effectiveness in protecting organizational assets against threats.

Aalignment with compliance requirements.

While continuous monitoring aids in demonstrating compliance, its fundamental purpose is not merely alignment with requirements, but confirming actual operational effectiveness.

Beffectiveness of controls.Correct

Continuous monitoring is implemented to regularly assess whether security controls are operating as intended and are still capable of mitigating risks effectively against evolving threats and changes in the environment. This ensures the controls maintain their protective function over time.

Ccontrol gaps are minimized.

Minimizing control gaps is a result of identifying ineffective controls or new risks through monitoring, but the overarching goal is the effectiveness of the controls themselves.

Dsystem availability.

System availability is one aspect that security controls protect, but it's not the primary purpose of monitoring the controls; rather, it's a desired outcome of effective controls.

Concept tested: Continuous security monitoring purpose

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-137.pdf

Topics

#Continuous monitoring#Security controls#Control effectiveness

Community Discussion

No community discussion yet for this question.

Full CISM Practice