Systems have a continuous monitoring plan that includes:
- conducting vulnerability scans for systems at least fortnightly
- conducting vulnerability assessments and penetration tests for systems prior to deployment, including prior to deployment of significant changes, and at least annually thereafter
- analysing identified vulnerabilities to determine their potential impact
- implementing mitigations based on risk, effectiveness and cost.