49 U.S.C. § 44916

(a) Periodic Assessments .— The Administrator of the Transportation Security Administration shall require each air carrier and airport (including the airport owner or operator in cooperation with the air carriers and vendors serving each airport) that provides for intrastate, interstate, or foreign air transportation to conduct periodic vulnerability assessments of the security systems of that air carrier or airport, respectively. The Transportation Security Administration shall perform periodic audits of such assessments. (b) Investigations .— The Administrator of the Transportation Security Administration shall conduct periodic and unannounced inspections of security systems of airports and air carriers to determine the effectiveness and vulnerabilities of such systems. To the extent allowable by law, the Administrator may provide for anonymous tests of those security systems.