A security control stops working silently after a system upgrade. What should the program add?

1. A longer control description
2. Only a new annual policy acknowledgment
3. A rule that upgrades prove stronger security
4. Change-triggered control validation and health monitoring