Enhancement Supplemental Guidance: The organization can extend and maximize the value of the ongoing assessment of security controls during the continuous monitoring process by requiring an independent certification agent or team to assess all of the security controls during the information system’s three-year accreditation cycle. Related security controls: CA-2, CA-4, CA-5, CA-6, CM-4.