The security officer for each institution shall report at least annually to the institution's board of directors on the implementation, administration, and effectiveness of the security program.