If a person submits a written reply within 30 calendar days of receipt of a preliminary notice of violation, the Director must make a final determination whether the person violated or is continuing to violate a classified information security requirement.

Based on a determination by the Director that a person has violated or is continuing to violate a classified information security requirement, the Director may issue to the person a final notice of violation that concisely states the determined violation, the amount of any civil penalty imposed, and further actions necessary by or available to the person. The final notice of violation also must state that the person has the right to submit to the Director, within 30 calendar days of the receipt of the notice, a written request for a hearing under § 824.8 or, in the alternative, to elect the procedures specified in section 234A.c.(3) of the Act, 42 U.S.C. 2282a.c.(3).

The Director must send a final notice of violation by certified mail, return receipt requested, within 30 calendar days of the receipt of a reply.

Subject to paragraphs (h) and (i) of this section, the effect of final notice shall be:

If a final notice of violation does not contain a civil penalty, it shall be deemed a final order 15 days after the final notice is issued.

If a final notice of violation contains a civil penalty, the person must submit to the Director within 30 days after the issuance of the final notice:

A waiver of further proceedings;

A request for an on-the-record hearing under § 824.8; or

A notice of intent to proceed under section 234A.c.(3) of the Act, 42 U.S.C. 2282a.(c)(3).

If a person waives further proceedings, the final notice of violation shall be deemed a final order enforceable against the person. The person must pay the civil penalty set forth in the notice of violation within 60 days of the filing of waiver unless the Director grants additional time.

If a person files a request for an on-the-record hearing, then the hearing process commences.

If the person files a notice of intent to proceed under section 234A.c.(3) of the Act, 42 U.S.C. 2282a.(c)(3), the Director, by order, shall assess the civil penalty set forth in the Notice of Violation.

The Director may amend the final notice of violation at any time before the time periods specified in paragraphs (d)(1) or (d)(2) expire. An amendment shall add fifteen days to the time period under paragraph (d) of this section.

The Director may withdraw the final notice of violation, or any part thereof, at any time before the time periods specified in paragraphs (d)(1) or (d)(2) expire.