Common criteria series CC4: ongoing and separate evaluations of whether controls are present and functioning, and how deficiencies are evaluated, communicated and corrected.
How the organization checks that controls are present and functioning through ongoing and separate evaluations: continuous monitoring, internal audit, penetration tests and independent certifications, with scope and frequency adjusted to risk and rate of change.
Evaluating internal control deficiencies and reporting them in time to the people who must act, including senior management and the board, then tracking corrective action to closure.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.