Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency.