v4 lets you set some control frequencies yourself, if you can justify them. Here's what a good analysis looks like.
Flexibility with accountability
Several v4 requirements let entities define how often an activity happens, provided a documented targeted risk analysis supports the choice.
Anatomy of a good analysis
Identify the asset, the threat, the likelihood and impact, and the resulting frequency, then review it at least annually.