OSCAL Parameters within PM-9: Risk Management Strategy
the frequency at which to review and update the risk management strategy is defined;