ID.IM-01: Improvements are identified from evaluations
Ex1: Perform self-assessments of critical services that take current threats and TTPs into consideration
Ex2: Invest in third-party assessments or independent audits of the effectiveness of the organization’s cybersecurity program to identify areas that need improvement
Ex3: Constantly evaluate compliance with selected cybersecurity requirements through automated means