(1) Each licensee shall be responsible for the continuing effectiveness of their security program. Each licensee shall ensure that the security program is reviewed to confirm compliance with the requirements of this chapter and that comprehensive actions are taken to correct any noncompliance which is identified. The review must include the radioactive material security program content and implementation. Each licensee shall periodically, at least annually, review the security program content and implementation.

(2) The results of the review, along with any recommendations, must be documented. Each review report must identify conditions that are adverse to the proper performance of the security program, the cause of the condition or conditions, and, when appropriate, recommend corrective actions, and corrective actions taken. The licensee shall review the findings and take any additional corrective actions necessary to preclude repetition of the condition or conditions, including reassessment of the deficient areas where indicated.

(3) The licensee shall maintain the review documentation for three years.