The security officer for each insured nonmember bank shall report at least annually to the bank's board of directors on the implementation, administration, and effectiveness of the security program.