A healthcare organization is developing its data privacy and security strategy. The leadership team is exploring different methods to monitor, evaluate, and improve security practices to ensure compliance with the Health Insurance Portability and Accountability Act $($HIPAA$).$ What would be the MOST appropriate measure to maintain and oversee its privacy and security controls?