This objective ensures your organization has formally documented which system-level assessments are being performed to evaluate the effectiveness of security controls related to Controlled Unclassified Information (CUI). These assessments must be clearly scoped, scheduled, and tied to your security objectives.