50 U.S.C. § 2421

(a) Policies and procedures required The Administrator shall establish procedures to ensure the maximum protection of classified information in the possession of the Administration. (b) Prompt reporting The Administrator shall establish procedures to ensure prompt reporting to the Administrator of any significant problem, abuse, violation of law or Executive order, or deficiency relating to the management of classified information by personnel of the Administration.