; and (B) include the integration of any national electronic identification systems of Americas partner countries. (2) Regular penetration testing by an outside organization certified by the Institute, to be conducted not less frequently than once a year. (3) Provision of a common vulnerability disclosure policy for systems operating under the framework. (4) Such other cyber security best practices as the Institute considers appropriate. (f) Enforcement (1) Audits Each system of an Americas partner country operating under the e-governance framework developed under subsection (a) shall undergo annual audits by an outside organization certified by the Institute. That audit shall assess the compliance of the system with the privacy and security requirements of this section and such other requirements as the Institute considers necessary. (2) Effect of noncompliance If an audit conducted under paragraph (1) indicates that a system or systems of an Americas partner country are substantially noncompliant with the privacy and security requirements of this section, the Institute may— (A) designate the system or systems as noncompliant; (B) recommend that other Americas partner countries take such actions as may be necessary to protect the privacy and security of the systems and data of those countries