▁to ▁measure ▁the ▁success ▁of ▁the ▁implementation ▁and ▁security ▁plans . ▁The ▁evaluation ▁is ▁important ▁for ▁clients ▁( and ▁possibly ▁third ▁parties ). ▁The ▁results ▁of ▁the ▁E valu ation ▁sub - process ▁are ▁used ▁to ▁maintain ▁the ▁agreed ▁measures ▁and ▁the ▁implementation . ▁E valu ation ▁results ▁can ▁lead ▁to ▁new ▁requirements ▁and ▁a ▁corresponding ▁Request ▁for ▁Change . ▁The ▁request ▁for ▁change ▁is ▁then ▁defined ▁and ▁sent ▁to ▁Change ▁Management . ▁ ▁The ▁three ▁sorts ▁of ▁evaluation ▁are ▁self - ass ess ment , ▁internal ▁aud it ▁and ▁external ▁aud it . ▁ ▁The ▁self - ass ess ment ▁is ▁mainly ▁carried ▁out ▁in ▁the ▁organization ▁of ▁the ▁processes . ▁In ternal ▁aud its ▁are ▁carried ▁out ▁by ▁internal ▁IT - aud itors . ▁External ▁aud its ▁are ▁carried ▁out ▁by ▁external , ▁independent ▁IT - aud itors . ▁Besides ▁those ▁already ▁mentioned , ▁an ▁evaluation ▁based ▁on ▁communic ated ▁security ▁inc idents ▁occurs . ▁The ▁most ▁important ▁activities ▁for ▁this ▁evaluation ▁are ▁the ▁security ▁monitoring ▁of ▁IT - system s ; ▁verify ▁the ▁security ▁legisl ation ▁and ▁security ▁plan ▁implementation ; ▁trace ▁and ▁react ▁to ▁und es irable ▁use ▁of ▁IT - supp lies . ▁ ▁Figure ▁ 2 . 4 . 1 : ▁Process - data ▁model ▁E valu ation ▁sub - process ▁ ▁The ▁process - data ▁diagram ▁illustrated ▁in ▁the ▁figure ▁ 2 . 4 . 1 ▁consists ▁of ▁a ▁meta - process ▁model ▁and ▁a ▁meta - data ▁model . ▁The ▁E valu ation ▁sub -