# Continuous Monitoring **Entity class:** Security-risk practice ## Definition **Continuous monitoring** maintains current awareness of a system's security and privacy state, control effectiveness, vulnerabilities, changes, and risk. It supports ongoing authorization by replacing one-time certification logic with recurring evidence and reassessment. ## Relationships - **RMF stage:** [[wiki/Risk Management Framework|Risk Management Framework]]. - **feeds:** [[wiki/Authorization to Operate|Authorization to Operate]] decisions. - **produces evidence for:** [[wiki/Audit and Accountability|Audit and Accountability]] and [[wiki/Machine-Readable Assurance|Machine-Readable Assurance]]. ## Sources / Provenance - [NIST — SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final)