This control requires your organization to continuously monitor the performance and effectiveness of the security controls protecting your systems—especially those used to safeguard Controlled Unclassified Information (CUI). It’s about ensuring your safeguards don’t just exist, but continue to work over time.