Which one of the following activities is not a component of the continuous monitoring process? a. Operation and maintenance b. Security control monitoring and impact analyses c. Status reporting and documentation d. Configuration management and control