Mechanisms exist to define the level of assessment rigor necessary to conduct a cybersecurity and/or data protection assessment.

Does the organization define the level of assessment rigor necessary to conduct a cybersecurity and/or data protection assessment?

- new control