164.308(a)(8) Evaluation (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Evaluation (Standard). Perform periodic technical and nontechnical evaluation. NIST recommends combining policy review, control testing, vulnerability assessments, and audits to evaluate ongoing compliance.
The examiner asks
- Show me the last technical and nontechnical evaluation of your security.
- What did it change, and where is that recorded?
Evidence to bring
- the evaluation report
- the changes it made
Source: 164.308(a)(8) at eCFR. Our statement of the clause, not the instrument verbatim.