164.308(a)(8): Evaluation
Perform periodic technical and non-technical evaluations to ensure that security policies and procedures meet the requirements.
164.308(a)(7)(ii)(E): Applications and Data Criticality Analysis
Assess the relative criticality of specific applications and data in support of other contingency plan components.