32 CFR § 2004.28 - Cost reports.

---
identifier: "/us/cfr/t32/s2004.28"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "32 CFR § 2004.28 - Cost reports."
title_number: 32
title_name: "National Defense"
section_number: "2004.28"
section_name: "Cost reports."
chapter_name: "INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL ARCHIVES AND RECORDS ADMINISTRATION"
part_number: "2004"
part_name: "NATIONAL INDUSTRIAL SECURITY PROGRAM (NISP)"
positive_law: false
currency: "2026-03-24"
last_updated: "2026-03-24"
format_version: "1.1.0"
generator: "[email protected]"
authority: "Section 102(b)(1) of E.O. 12829 (January 6, 1993), as amended by E.O. 12885 (December 14, 1993), E.O. 13691 (February 12, 2015), and section 4 of E.O. 13708 (September 30, 2015)."
regulatory_source: "83 FR 19951, May 7, 2018, unless otherwise noted."
cfr_part: "2004"
---


# 2004.28 Cost reports.

(a) Agencies must annually report to the Director, ISOO, on their NISP implementation costs for the previous year.

(b) CSAs must annually collect information on NISP implementation costs incurred by entities under their cognizance and submit a report to the Director, ISOO.