Which of the following is the final phase in the C&A process?

• A. Initiation
• B. Certification
• C. Accreditation
• D. Monitoring

Answer: (D)

Monitoring is the final phase because authorization isn’t a one-time event; it relies on ongoing oversight of the system’s security controls. After a system earns authorization to operate, continuous monitoring keeps track of how well those controls function, watches for new vulnerabilities, configuration changes, patch status, and incident activity, and assesses whether the risk posture remains acceptable. If changes in the system or environment raise risk or if controls weaken, the authorization decision may be revisited and reauthorization pursued. This continuous activity ensures the system stays compliant over time, making monitoring the concluding, perpetual phase in the C&A lifecycle.