110
National Critical Information Infrastructure in order to evaluate compliance with the
provisions of section 58(6) of this Act.
(2)
Before an audit referred to in subsection (1) is performed on a
National Critical Information Infrastructure, the owner of, or person in control of, a
National Critical Information Infrastructure must, at least 30 days in advance of the date
of the audit, notify the Director-General: State Security, in writing of—
(a)
the date on which an audit is to be performed; and
(b)
the particulars and contact details of the person who is responsible for the overall
management and control of the audit.
(3)
The Director-General: State Security may designate any member,
person or entity, referred to in section 52(4) of this Act, to monitor, evaluate and report
on the adequacy and effectiveness of any audit referred to in subsection (1).
(4)
The owner of, or person in control of, a National Critical Information
Infrastructure must, within 30 days after an audit referred to in subsection (1) has been
completed, report in the prescribed form and manner to the Director-General: State
Security regarding the outcome of the audit referred to in subsection (1).
(5)
The Director-General: State Security may request the owner of, or
person in control of, a National Critical Information Infrastructure to provide such
additional information as may be necessary within a specified period, in order to
evaluate the report referred to in subsection (4).
(6)
If the owner of, or person in control of, a National Critical
Information Infrastructure—
(a)
fails to cause an audit to be performed on a National Critical Information
Infrastructure in order to evaluate compliance with the provisions of section 58(6)
of this Act as contemplated in subsection (1);
(b)
fails to give a report referred to in subsection (3) to the satisfaction of the
Director-General: State Security after he or she has been requested to do so in
terms of subsection (5), to provide additional information; or