What it asks for. Point (f) requires policies and procedures to assess the effectiveness of cybersecurity risk management measures. Entities must check that their controls actually work, not just that they exist.
In practice. The entity defines metrics and testing for key controls, runs internal audits, technical tests such as penetration testing and configuration reviews, and reviews results with management. Findings are tracked to remediation and feed back into the risk assessment. Evidence includes an assurance plan, audit and test reports, metrics dashboards and management review minutes.
Common gaps. Effectiveness is often inferred from policy existence or tool deployment. Metrics tend to measure activity, such as number of scans, rather than outcomes such as time to remediate or reduction in exposure.