Policy assessments should be considered as a cybersecurity best practice and should be conducted annually with other assessments such as vul