ISM-1063 Removed History Priority must 2010 The report must contain a declaration of compliance by the agency head stating any areas of noncompliance, including details on mitigation measures taken to lessen security risks.