Well if you don't do it and there is no penalty, doesn't that mean it isn't required?
Well, among the penalties are that the FISA act give Flynn standing to sue each person involved, in their individual capacity [not as employees of the government], for actual damages or statutory damages of $100 per day, whichever is greater, punitive damages, costs and attorneys fees [this last is the really expensive one].
And then there are the criminal penalties (10 years for each violation). People who are vulnerable would include Lynch and Sally Yates since both were attorneys general with specific statutory duties, a lot of other underlings in DOJ, and then the IC to the extent they were involved.