Security and risk management also involves the ongoing monitoring and review of implemented controls to ensure their effectiveness and to identify emerging risks. This includes regular security assessments, audits, and incident response planning to detect and respond to security incidents in a timely manner.

How you monitor your controls will follow the budget and priorities of your organization. You can manually do internal self-assessments at least annually. Ideally, at least annually, a third-party penetration test should be carried out on your network. At a more advanced level, you should bring in an outside third party to conduct an assessment of your network. If your organization has decided to comply with SOC2, then you would do at least one annual self-assessment, and an outside auditor would come in annually to do an audit.

At a more advanced level, you can carry out automated continuous monitoring of your organization’s controls. The...