Which program is a system that facilitates ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions?

• A. Continuous Monitoring Program
• B. Continuous Evaluation
• C. Continuous Vetting
• D. Security Awareness Program

Answer: (A)

Ongoing visibility into threats, vulnerabilities, and the information security posture to support risk decisions is achieved through a Continuous Monitoring Program. This system continuously collects data on security controls, threat indicators, and vulnerability status, then analyzes and presents it so risk managers can see the current risk level, detect changes quickly, and respond in a timely way. It provides up-to-date metrics, trends, and alerts that inform decisions about prioritizing remediation, adjusting controls, or reallocating resources, rather than relying on point-in-time assessments.

Continuous evaluation focuses on ongoing assessments of performance or compliance but isn’t specifically the mechanism for real-time threat and vulnerability awareness across the organization. Continuous vetting centers on ongoing checks of individuals for eligibility or clearance. A security awareness program targets training and user behavior, not the broader, continuous monitoring of threats and vulnerabilities that supports organizational risk management decisions.