the breach and the date of the discovery of the breach, if known. (2) A description of the types of unsecured sensitive personally identifiable information that were involved in the breach. (3) The steps individuals should take to protect themselves from potential harm resulting from the breach. (4) A brief description of what the entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches. (5) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, a website, and a postal address. (e) Posting on FTC public website The Commission shall make available to the public on the website of the Commission a list that identifies each covered entity that is required to notify 500 or more individuals of a breach under subsection (a)(1)(B), except to the extent notification with respect to such breach is subject to a delay for law enforcement or national security purposes under subsection (f). (f) Delay of notification for law enforcement or national security (1) In general If the Director of the Federal Bureau of Investigation determines that the notifications required under subparagraphs (B), (C), and (D) of subsection (a)(1) would impede a criminal investigation or national security activity, the time period for such notifications shall be extended 30 days upon written notice from the Director to the covered entity that experienced the breach and to the Commission. (2) Extended delay of notification If the time period for notification required under subparagraphs (B), (C), and (D) of subsection (a)(1) is extended pursuant to paragraph (1), a covered entity shall provide the notification within such time period unless the Director of the Federal Bureau of Investigation provides written notice to the covered entity and to the Commission that further extension of the time period is necessary. The Director may extend the time period for additional periods of up to 30 days