Which steps make up the continuous monitoring cycle in NIST SP 800-137? Choose three.

Answer: A. Define the strategy and establish the programme.
B. Implement the programme, then analyse data and report findings.
D. Respond to findings, then review and update the programme and strategy.

SP 800-137's process runs define, establish, implement, analyse and report, respond, then review and update. Authorisation is a Risk Management Framework step, not part of the monitoring cycle.

Source: NIST SP 800-137 (NIST) — SP 800-137 > Chapter 3 The Process