Sec. 204. Protection of covered data
355 words·~2 min read·
/bill/116/s/4626/is/section-204A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity shall establish, implement, and maintain reasonable administrative, technical, and physical data security policies and practices to protect against risks to the confidentiality, security, and integrity of covered data. The data security policies and practices required under subsection
(a)shall be— appropriate to the size and complexity of the covered entity, the nature and scope of the covered entity’s collection or processing of covered data, the volume and nature of the covered data at issue, and the cost of available tools to improve security and reduce vulnerabilities; and designed to— identify and assess vulnerabilities to covered data; take reasonable preventative and corrective action to address known vulnerabilities to covered data; and detect, respond to, and recover from cybersecurity incidents related to covered data. The Commission may, pursuant to a proceeding in accordance with section 553 of title 5, United States Code, issue regulations to identify processes for receiving and assessing information regarding vulnerabilities to covered data that are reported to the covered entity. In promulgating regulations under this paragraph, the Commission shall consult with, and take into consideration guidance from, the National Institute for Standards and Technology Not later than 1 year after the date of enactment of this Act, the Commission shall issue guidance to covered entities on how to— identify and assess vulnerabilities to covered data, including— the potential for unauthorized access to covered data; vulnerabilities in the covered entity’s collection or processing of covered data; the management of access rights; and the use of service providers to process covered data; take reasonable preventative and corrective action to address vulnerabilities to covered data; and detect, respond to, and recover from cybersecurity incidents and events. A covered entity that is required to comply with title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq.) or the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 et seq.), and is in compliance with the information security requirements of such Act, shall be deemed to be in compliance with the requirements of this section with respect to covered data that is subject to the requirements of such Act.
Connectionstraces to 2
Citation graph
cites case law
Cites 2Cited by 0 across 0 sources