Assess the environment on a defined schedule and whenever a material change occurs: a major upgrade, new application integration, infrastructure move, security incident, acquisition, supplier change, or change in the sensitivity of the data. High-risk findings should be tracked continuously until they are resolved or formally accepted.