A person in control of a critical infrastructure must appoint a person in the employ of the critical infrastructure as
security manager to-
(a) implement and monitor, on behalf of the person in control of the critical infrastructure, the prescribed security policy and plan compiled for that critical infrastructure;
(b) authorise access to critical infrastructure or oversee the authorisation of such access by security personnel working under his or her direction;
(c) liaise with any security service provider appointed by the person in control of that critical infrastructure;
(d) implement the directions contemplated in section 25(1)(b);
(e) provide monthly reports to the person in control of that critical infrastructure on the functions contemplated in paragraphs (a), (b) and (c); and
(f) perform such other functions related to the securing of that critical infrastructure as may be assigned to him or her by the person in control of that critical infrastructure: Provided that such security manager may only be appointed after successful completion of security vetting by
the State Security Agency.