Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

By assessing your security controls you can identify issues before an attacker can exploit them.

By undergoing this gap analysis your are meeting this control. Your security controls are being assessed for their effectiveness and gaps are identified. You should periodically (e.g., annually) assess your security controls and make improvements as needed. The assessments can be conducted internally, you are not required to hire a third party.