Which practice supports ongoing monitoring in SecAI+ risk management?

• A. Implementing audit trails, compliance reviews, and periodic policy updates
• B. Relying on initial assessment
• C. Ignoring data subject rights
• D. No change management

Answer: (B)

Ongoing monitoring relies on having a baseline to compare current conditions against. Starting with an initial assessment sets that baseline by defining the expected risk posture, controls in place, data flows, and acceptable risk levels. With that reference, you can detect drift, observe how threats or data use change over time, and determine when actions or control adjustments are needed. While activities like audit trails, compliance reviews, and periodic policy updates are important for evidence and governance, they support monitoring by documenting what changed and why, and without a defined baseline you wouldn’t easily recognize what constitutes an abnormal or elevated risk. Ignoring data subject rights or avoiding change management would undermine the effectiveness and adaptability of the risk program.