Determine how to integrate a continuous monitoring program into the organization’s broader information security governance structures and policies.