Requirement
"Compliance with the organization’s information security policy, topic-specific policies, rules and standards shall be regularly reviewed."[1]
Explanation
Periodically (e.g. annually) compare the organization's security policies against the organization's technical and physical security controls to determine if the organization's policy is infact being implemented.
