(a) The agency must establish a self-inspection program pursuant to the requirement in § 2002.8(b)(4).

(b) The self-inspection program must include:

(1) At least annual review and assessment of the agency's CUI program. The agency head or CUI SAO should determine any greater frequency based on program needs and the degree to which the agency engages in designating CUI;

(2) Self-inspection methods, reviews, and assessments that serve to evaluate program effectiveness, measure the level of compliance, and monitor the progress of CUI implementation;

(3) Formats for documenting self-inspections and recording findings when not prescribed by the CUI EA;

(4) Procedures by which to integrate lessons learned and best practices arising from reviews and assessments into operational policies, procedures, and training;

(5) A process for resolving deficiencies and taking corrective actions; and

(6) Analysis and conclusions from the self-inspection program, documented on an annual basis and as requested by the CUI EA.