My understanding is that the law is that government agencies may access companies' infrastructure to conduct security and compliance audits.

The worry is that this may be used to access companies' data.