Which two documents does SP 800-137 say a well-run monitoring programme keeps current, rather than letting them age between authorisations? Choose two.

Answer: C. The system security plan and the risk assessment report
B. The security assessment report and the corrective action plan

SP 800-137 states the output of a well-managed programme can be used to maintain a system's authorisation and keep required information — the system security plan, risk assessment report, security assessment report and plan of action and milestones — up to date.

Source: NIST SP 800-137 (NIST) — Sec. 2.2 Ongoing System Authorizations