Continually Monitor the Effectiveness of implemented controls by; - Testing the controls with known threats. - Leveraging security metrics to report on coverage and status (use of KRI, KPI and KCI).