4.4.3.9

Cyber Security Risk Assessment

Periodically Test and/or Review Controls

Cyber Security Risk Assessment – Periodically Test and/or Review Controls – The organization shall periodically review and/or test cyber security controls to ensure effectiveness. Testing and/or review shall take place at a minimum annually, or if a major change occurs in their system.