Random testing of security procedures should also take place .
Security assessments of these facilities should take place every three years .
in a tcp/ip model, this layer corresponds to the session, presentation, and application layers of the osi model.