Which practice most directly validates the ongoing effectiveness of security controls after deployment?

Which practice most directly validates the ongoing effectiveness of security controls after deployment?

• A. Annual user surveys
• B. Reducing logs
• C. Continuous monitoring and periodic assessments
• D. Replacing controls yearly

Answer: (C)

Ongoing validation after deployment comes from continuously checking that security controls keep working as intended as the environment changes. Continuous monitoring provides real-time visibility into how controls perform, including detecting configuration drift, unauthorized changes, and security incidents, with alerts and dashboards that show whether protections are staying effective. Pair that with periodic assessments—scheduled, formal checks like tests and independent reviews—to verify that controls still meet requirements, enforce policies, and identify gaps that need fixes. This combination gives both immediate signals and structured verification that controls remain effective over time. Annual user surveys focus on perceptions rather than technical effectiveness, so they don’t reliably indicate whether safeguards are actually working. Reducing logs cuts visibility and makes it harder to assess control performance. Replacing controls yearly isn’t about validating ongoing effectiveness; it’s a change in controls, not a measure of whether current controls remain effective.

Ongoing validation after deployment comes from continuously checking that security controls keep working as intended as the environment changes. Continuous monitoring provides real-time visibility into how controls perform, including detecting configuration drift, unauthorized changes, and security incidents, with alerts and dashboards that show whether protections are staying effective. Pair that with periodic assessments—scheduled, formal checks like tests and independent reviews—to verify that controls still meet requirements, enforce policies, and identify gaps that need fixes. This combination gives both immediate signals and structured verification that controls remain effective over time.

Annual user surveys focus on perceptions rather than technical effectiveness, so they don’t reliably indicate whether safeguards are actually working. Reducing logs cuts visibility and makes it harder to assess control performance. Replacing controls yearly isn’t about validating ongoing effectiveness; it’s a change in controls, not a measure of whether current controls remain effective.