Regularly test and validate the effectiveness of implemented controls. An untested control provides a false sense of security.