Code of Federal Regulations Title 32. National Defense § 32.2004.26 Reviews of entity NISP implementation

(a) The responsible CSA conducts recurring oversight reviews of entities' NISP security programs to verify that the entity is protecting classified information and is implementing the provisions of the NISPOM (or equivalent). The CSA determines the scope and frequency of reviews. The CSA generally notifies entities when a review will take place, but may also conduct unannounced reviews at its discretion.

(b) CSAs make every effort to avoid unnecessarily intruding into entity employee personal effects during the reviews.

(c) A CSA may, on entity premises, physically examine the interior spaces of containers not authorized to store classified information in the presence of the entity's representative.

(d) As part of a security review, the CSA:

(e) As a result of findings during the security review, the CSA may, as appropriate, notify:

(f) The CSA maintains a record of reviews it conducts and the results. Based on review results, the responsible CSA determines whether an entity's eligibility for access to classified information may continue. See § 2004.32(g).