Incentive to control

Suggestions for inspection are processed by the Department of Inspection and Methodology of the NSA. Incentives to carry out the inspection are submitted by the Office's internal services, which ensure the execution of professional agendas in the field of protection of classified information. Further input may also be provided from external sources (e.g. from the public or other central administrative authorities). Relevant proposals sent are expertly assessed and then included in the control plan.

Control activity plan

The plan of control activities is always prepared by the Department of Control and Methodology of the NSA for individual quarters. The audit plan is approved by the Director of the NSA. The number of individual controls included in the control activity plan may vary, mainly depending on the complexity of the planned controls. The plan may be supplemented during the quarter, in particular in cases where a suspected breach of obligations under the Act and implementing legislation is detected. The Director of the NSA decides on the inclusion of further control in the area of protection of classified information in the plan of control activities.

Preparation for the inspection

Data from internal databases and information from other institutions are collected in preparation for the audit by the head of the audit group. The information collected during the preparation for the inspection is then used in the actual performance of the inspection. The head of the control group shall share the information obtained as part of the briefing with the other members of the control group, depending on their professional focus.

Commencement of the inspection

By default, the control in the area of protection of classified information starts with the delivery of the notice of initiation of the control to the data box of the inspected person. The on-the-spot check shall be formally initiated at a meeting between the representatives of the inspected person and the head of the control group together with the inspecting officers. During this meeting, the head of the control group is presented to the inspected person by the individual inspecting officer, including their professional focus on the given areas of protection of classified information. Furthermore, the timetable of the inspection and other organisational matters are presented and, where appropriate, specified in order to ensure the optimal course of the inspection.

Execution of control

A different number of controllers participate in the actual exercise of control, mainly depending on the complexity of the control. In the case of inspected persons who handle a large number of classified documents or have a large number of secure areas, or in the case of an inspected person, a larger number of natural persons who have access to classified information, the check may take place for several weeks. In the case of inspected persons who handle a smaller number of classified documents, have in the order of units of secured areas and do not have a larger number of natural persons who have access to classified information, the check is usually carried out for several days.

This is the most important part of the inspection, during which the inspectors check whether the area of protection of classified information complies with the law. Reviewers shall review factual, procedural and formal accuracy. The result of the actual performance of the inspection is an objective, evidence-based assessment of the facts and deficiencies found, which are described in detail in the individual parts of the inspection report.

Report on the outcome of the inspection

From the collected documents and knowledge, the parts of the inspection report are prepared by the individual inspectors, which are then processed by the head of the inspection group into a single document. The result is a comprehensive report on the outcome of the inspection. It is usually a document about the lower tents, which contains a detailed description of the facts and shortcomings found and an emphasis on the systemic approach, as well as an effort to capture potential problems in the future. The prepared report on the outcome of the inspection shall be forwarded by the group leader to the inspected person and shall inform him/her of its content.

Submission of objections to control findings

If the inspected person does not agree with the content of the inspection report, he or she may, within 15 days of receipt of the report on the outcome of the inspection, submit written objections to the group leader against the specific inspection findings. The group leader shall draw up a document on the settlement of objections to control findings, which shall take the form of a decision. It shall then inform the inspected person of the settlement of the objections.

Follow-up

In cases where the inspected person has been found to have serious deficiencies in the protection of classified information, the NSA may carry out a follow-up inspection to evaluate the implemented corrective measures.