Chapter 4. General requirements concerning protective security work Section 4-1.Security management Responsibility for protective security work rests with the head of an undertaking. Protective security work shall be incorporated into the undertaking's management system. The undertaking's state of security shall be checked regularly. The undertaking shall ensure that employees, suppliers and contractors have an adequate understanding of risks and security. Chapter 9 applies to suppliers in classified procurements. The King may issue regulations on security management. Section 4-2.Risk assessment Undertakings shall conduct regular risk assessments. The assessment shall form the basis for implementation of protective security measures. As part of the assessment, each undertaking shall identify other undertakings on which it is dependent for its proper functioning. The assessment shall be reviewed regularly, and be revised if necessary. The supervisory authority shall on request provide advice and guidance on the assessment. The King may issue regulations on the conduct of risk assessments. Section 4-3.Duty to implement security measures and exercises Undertakings shall implement such protective security measures as are required to ensure an appropriate level of security and reduce the risk associated with activities which present a threat to security. Such measures may be implemented in conjunction with other protective security measures taken by each undertaking, provided that the requirements of this act are met. The cost of a security measure shall be reasonably proportionate to what the measure may achieve. The undertaking shall conduct regular exercises to evaluate the effect of implemented security measures. The King may issue regulations on the duties of undertakings covered by the act, and on exercises. Section 4-4.Documentation requirement 8/30