Define the expected outcome—documents whether identified risk will be mitigated, transferred, avoided, or accepted—and test it with realistic scenarios. Record the owner, scope, evidence, exceptions and review date. Combine technical testing with operational confirmation so a configured control is not mistaken for an effective control.

NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework