Annual control testing has repeatedly found that a critical configuration control failed months before the test, leaving long periods of undetected exposure. What would BEST address this problem?
Select an answer to reveal the explanation.
Short Explanation
Checking your smoke alarm once a year means it could've been dead for eleven months before you notice. Continuous monitoring is the alarm that beeps the moment its battery dies. The trap is tweaking the annual test; you still only look once a year.
Full Explanation
The problem is the interval between checks: a control that can fail at any time but is tested once a year may be broken for most of that year without anyone knowing. Continuous control monitoring evaluates the control automatically and frequently, for example by comparing configurations against an approved baseline, and alerts the control owner as soon as a deviation appears. That reduces the window of exposure from months to the time it takes to respond, and it also produces ongoing evidence of operation. Extending the annual test to a larger sample improves confidence about the state of the control at the moment of testing but does nothing about failures that occur between tests. An annual attestation by the control owner adds an assertion, not evidence, and it occurs at the same yearly frequency, so undetected periods remain. Moving the annual test earlier in the year changes when the snapshot is taken but not how often, so the length of potential undetected exposure is unchanged. Exam caveat: periodic independent testing still has value alongside continuous monitoring, because it validates that the monitoring itself is correctly designed and working. Operational check: confirm that the monitored baseline is approved, alerts route to a named owner, and the time from deviation to correction is measured and reported.