Which one of the following activities is not a component of the continuous monitoring process?
a. Operation and maintenance
b. Security control monitoring and impact analyses
c. Status reporting and documentation
d. Configuration management and control