ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST RMF and the associated guidance in publications such as SP 800-37 and SP 800-137 state that organizations are expected to establish monitoring and review frequencies that are commensurate with the level of risk. Systems with higher impact levels or operating in rapidly changing, high-threat environments warrant more frequent compliance reviews to ensure that security and privacy controls remain effective. While audit schedules, budget cycles, and leadership preferences may affect logistical planning, they are secondary to the fundamental requirement that monitoring be driven by the system's risk, criticality, and environmental volatility. Therefore, basing the review cadence on the system's impact level and how quickly its threat or technology environment changes is the most appropriate approach. Other options focus on administrative convenience rather than risk management, and thus do not satisfy RMF expectations.