Continual improvement is limited only by the speed of collecting information and:

1. Collecting data is only half of the loop. 2. Nothing improves until something is done about it. 3. Continual improvement is limited only by the speed with which the organization can collect information and respond to findings. 4. So the answer is responding to findings. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_