Evaluating whether the controls are actually working
Think of it likePressing the test button on the smoke alarm instead of trusting the little green light.
In plain English
The organization selects and performs ongoing checks, separate evaluations, or both, to confirm that controls are present and functioning rather than merely documented.
Related CSF, CIS and ISO controls (unofficial mapping)