How can a TA verify the effectiveness of security controls after a change?

• A. Rely on annual risk assessments only.
• B. Revalidate through testing, monitoring, and audits; compare against baselines and remediation of any gaps.
• C. Ignore changes and assume controls remain effective.
• D. Solicit external audits only after several years.

Answer: (B)

Verification after a change requires re-testing the control to ensure it still operates as intended, continuous monitoring to catch any drift or new issues, and audits to provide independent validation of its effectiveness. Comparing current performance against established baselines helps you see whether the change introduced gaps or increased risk, and any identified gaps should be remediated and the baselines updated. Relying only on intermittent or external checks or ignoring changes leaves you blind to new vulnerabilities and incomplete risk management. Annual risk assessments alone may be outdated the moment a change occurs, and waiting for external audits years later delays detection of problems. By combining testing, monitoring, and audits and acting on gaps, you maintain ongoing assurance that security controls remain effective after changes.