Then decide on when you do the security assessment. The assessment check if the controls are in place and working correctly.