CALs should be reviewed regularly, especially when there are significant changes in the threat landscape, technology, or operational environment. An annual review is a common practice, but some situations may warrant more frequent assessments.