A "major modification" (such as a system upgrade, new integration, or architectural change) can inadvertently disable or bypass previously effective security controls. Evaluating immediately afterward ensures that the security posture remains intact. When a system is modified, the threat landscape for that specific asset often changes. You must evaluate to confirm that the controls are still appropriate for the new configuration. In a mature organization, security testing and evaluation are mandatory final steps in the Change Management process before a system is considered "fully operational."