Assess risk and determine needs Establish a central management focal point Implement appropriate policies and related controls Promote awareness Monitor and evaluate policy and control effectiveness
392462
Policy and control effectiveness must be monitored and evaluated.
392463
There is no need to monitor or evaluate policy and control effectiveness.