Canada ITSG-33 - IT Security Risk Management A1-4.4: 4.4 Monitor and assess the performance of security controls

What does A1-4.4 require?

The department continuously monitors and assesses the performance of common and system controls by collecting, consolidating and analysing performance metrics, with operations groups reporting summaries to the IT security function and sensitive monitoring kept by that function where separation of duties is needed. Assessment also covers review of security-related change and problem records and incident reports, security testing (functional, vulnerability assessment, penetration testing) and review of component security configurations. Results tell authorities whether systems can keep their authorization.