FISMA 3554(b)(5): 3554(b)(5) Testing and evaluation at least annually with automated tools

The program includes periodic testing and evaluation of the effectiveness of information security policies, procedures and practices, at a frequency depending on risk but no less than annually, which covers the management, operational and technical controls of every system in the section 3505(c) inventory, may include testing relied on in the section 3555 evaluation, and uses automated tools consistent with NIST standards and guidelines.