Mechanisms exist to address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks.
Does the organization address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks?