Assessing effectiveness

The last family closes the loop: how do you know your measures actually work? Without assessment, every other family stays an assumption.

What this means in practice

You periodically assess whether your measures work, test that through tests, audits and exercises, follow up findings with an owner and a deadline, and assess and record alerts and threat information.

Why this is in the law

This is why Munitor asks for evidence per measure: working demonstrably means you can show when something was last tested, not just that a measure was taken at some point.