Which statement best describes continuous monitoring vs periodic assessment in Annex B?

• A. Continuous monitoring runs only during business hours.
• B. Periodic assessment occurs in real time.
• C. Continuous monitoring is manual and infrequent.
• D. Continuous monitoring runs continuously to detect changes; periodic assessment occurs at scheduled intervals.

Answer: (D)

Continuous monitoring means data collection and analysis are ongoing, continuously watching for changes in the system, configurations, and risk indicators so you can detect and respond to events as they happen. Periodic assessment, by contrast, is performed at defined intervals, giving a snapshot of the security posture at that time and enabling remediation planning between assessments.

The statement that best captures this distinction is that continuous monitoring runs continuously to detect changes; periodic assessment occurs at scheduled intervals. The idea that continuous monitoring only runs during business hours, or that periodic assessment is real-time, or that continuous monitoring is manual and infrequent, conflicts with the ongoing, often automated nature of continuous monitoring and the scheduled cadence of periodic assessments.