Threats and vulnerabilities shall be identified.
A process shall be established to monitor, identify, and document vulnerabilities of the organisation's business critical systems in a continuous manner.
To ensure that organization's operations are not adversely impacted by the testing process, performance/load testing and penetration testing on the organization’s systems shall be conducted with care.