Explanation
The primary purpose for continuous monitoring of security controls is to ensure that the controls are effective in achieving the desired security objectives and mitigating the identified risks. Continuous monitoring provides ongoing assurance that the planned and implemented security controls are aligned with the organizational risk tolerance and can respond to changes in the threat environment, the system, or the business processes. Continuous monitoring also helps to identify and address any control weaknesses or gaps in a timely manner. (From CISM Review Manual 15th Edition and NIST Special Publication 800-1371) References: CISM Review Manual 15th Edition, page 181, section 4.3.2.4; NIST Special Publication
800-1371, page 1, section 1.1.