The SPCSA is required to conduct a risk assessment and provide appropriate risk-tier level monitoring as a requirement of the Code of Federal Regulations (CFR.)