Requirement 12.1.3

Includes a review at least once a year and updates when the environment changes.