4. Assessment, Monitoring, and Assurance—Ongoing audits and monitoring
of risk levels to ensure that they remain within acceptable thresholds;
also determine the effectiveness of software security risk management
measures in achieving legal, regulatory, and security policy compliance.