Continuous Monitoring is the fourth phase of the security certification and accreditation process. What activities are performed in the Continuous Monitoring process? Each correct answer represents…

The security accreditation decision is made by the Designated Approving Authority (DAA) in the Authorization phase, which precedes continuous monitoring, rather than being an activity within continuous monitoring itself.

Security control monitoring and impact analyses of changes to the information system are fundamental to continuous monitoring, as they involve regularly assessing the effectiveness of implemented controls and understanding how system modifications affect the security posture.

Security accreditation documentation is prepared during the earlier phases of the C&A process, such as Security Assessment and Authorization, to support the accreditation decision, not as a primary activity of the ongoing continuous monitoring phase.

Configuration management and control ensures that the system's baseline configuration is maintained securely and that all changes are managed and assessed for security implications, which is a core activity within continuous monitoring.

Status reporting and documentation involves consistently communicating the security status, identified risks, and remediation activities to stakeholders, providing transparency and accountability in the continuous monitoring process.