A cybersecurity strategy should be reviewed and adapted as threats and business needs change.

### Why this is right A strategy is described as a living document because the organization’s systems, priorities, and risks do not remain fixed. A plan that is not reviewed can become poorly matched to current conditions. ### The concept Monitoring helps an organization notice new threats and weaknesses. Review uses that information to update policies, procedures, and controls. This is different from treating strategy as a document that is completed once and then left unchanged. ### Terms - **Threat**: a possible cause of harm to an asset. - **Vulnerability**: a weakness that a threat could exploit. ### Remember When the environment changes, review the plan as well as the technology.