$36)$ Ongoing monitoring of control performance against the requirement is very important in maintaining an acceptable system security$/$privacy posture after the system is approved by the Authorizing Official. At what level of the RMF is the continuous monitoring strategy developed? A$)$ Prepare step B$)$ Assess step C$)$ Authorize step D$)$ Continuous monitoring stepNOT Option D$-$Continuous monitoring as earlier said, occurs after the system has been authorized to operate. The authorization decision is based on a point$-$in$-$time evaluation of the system and so the security$/$privacy posture of the system could change at any time because of improvements in technology and changing threat factors. See task P$-7$ in NIST $800-37$rv$2$ for details.