This objective ensures your organization is not only identifying and documenting system-level assessments, but also actively performing them to evaluate the effectiveness of security controls protecting Controlled Unclassified Information (CUI).