If organizational leadership determines that its required continuous monitoring plan is too costly for the...

Determine if the organization’s risk posture allows the system to operate without the continuous monitoring of the controls in question

Identify and monitor only the technical controls, as they cover the most critical threats to the organization

Ensure that the organization’s Configuration Management (CM) and control processes are documented and executed according to policy

Continue developing the system using a secure Software Development Life Cycle (SDLC) approach and testing, thereby eliminating the need for monitoring the security controls