ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Task M-1 in the Monitor step of NIST SP 800-37 Rev. 2 requires the development of a system-level continuous monitoring strategy (sometimes documented as a continuous monitoring plan or strategy annex to the SSP). This strategy must define how often each implemented or inherited control will be assessed and list the specific events-such as major configuration changes, shifts in the threat environment, or discovery of new vulnerabilities-that will trigger an out-of-cycle reassessment or reauthorization. While the SSP may reference the strategy, and other plans (e.g., configuration management or incident response plans) discuss related activities, they are not required to contain the detailed schedule and trigger list. The authorization decision document likewise does not include those operational details.