; (bb) encryption for data at rest; (cc) encryption for data in transit; (dd) systemwide data minimization evaluations and policies; and (ee) data recovery capability; and (ii) create and maintain documentation demonstrating that the covered consumer reporting agency is employing reasonable technical measures and corporate governance processes for continuous monitoring of data, intrusion detection, and continuous evaluation and timely patching of vulnerabilities; (C) annually examine the data security measures of covered consumer reporting agencies for compliance with the standards promulgated under subparagraph (B); (D) investigate any covered consumer reporting agency if the Office has reason to suspect a potential covered breach or noncompliance with the standards promulgated under subparagraph (B); (E) after consultation with members of the technical and academic communities, develop a rigorous, repeatable methodology for evaluating, testing, and measuring effective data security practices of covered consumer reporting agencies, that employs forms of static and dynamic software analysis and penetration testing; (F) submit to Congress an annual report on the findings on any investigation under subparagraph (C); (G) determine whether covered consumer reporting agencies are complying with the regulations promulgated under subparagraph (B); and (H) coordinate with the National Institute of Standards and Technology and the National Cybersecurity and Communications Integration Center of the Department of Homeland Security; and (2) may— (A) investigate any breach to determine if the covered consumer reporting agency was in compliance with the regulations promulgated under paragraph (1)(B)