What is the role of ongoing risk management in CUI-storing systems?

• A. Ongoing risk management is a required part of security authorization and operation.
• B. Ongoing risk management is optional for CUI systems.
• C. Risk management is only needed during initial setup.
• D. Risk management is handled by external auditors only.

Answer: (A)

Ongoing risk management is essential because protection of CUI isn’t a one-time task. It’s an ongoing process that continuously evaluates threats, vulnerabilities, and the effectiveness of implemented controls, then updates protections as conditions change. In practice, this means a system must be under continuous monitoring, with regular risk assessments, evidence of control effectiveness, and timely remediation decisions, all feeding back into the authorization to operate and the day-to-day operation of the system.

This continual approach is required by the security framework DoD uses for CUI, where the authorization decision hinges on a current risk posture and the ability to adapt to new risks. The system security plan stays living, vulnerability management remains active, and any new threats trigger updates to controls and documentation. External audits may review the process, but they don’t replace the internal, ongoing management needed to keep CUI protected.