Assess risk and determine needs Establish a central management focal point Implement appropriate policies and related controls Promote awareness Monitor and evaluate policy and control effectiveness
There is no need to monitor or evaluate policy and control effectiveness.