Watch this video on YouTube
Who is responsible for ensuring that security controls are regularly assessed for effectiveness?