Monitoring various aspects of the organization 's security-related activities by testing controls , accounting for the number and types of security incidents , and evaluating compliance with policies .
No monitoring is conducted of the organization 's security-related activities .