While reviewing your policies to see how you handled Vanta templates with the requirement for yearly penetrations tests, I noticed you removed this from the Operations Security Policy. Was it your intention to keep the yearly requirement for a penetration test in your Risk Management Policy? If this was an oversight, I wanted to draw your attention to it.

Risk Management Policy

Risks are assessed and ranked according to their impact and their likelihood of occurrence. A formal Risk Assessment, and network penetration tests, will be performed at least annually and shall take into consideration the results of any technical vulnerability management activities performed in accordance with the Operations Security Policy.