; (II) a detailed time line with specific deadlines for addressing the known information security vulnerability; and (III) an update of any such time line and the rationale for any deviation from the time line. . 207. Internal risk controls Section 2(a)(12) of the Commodity Exchange Act ( 7 U.S.C. 2(a)(12) ), as amended by section 205 of this Act, is amended by adding at the end the following: (C) Internal risk controls The Commission, in consultation with the Chief Economist, shall develop comprehensive internal risk control mechanisms to safeguard and govern the storage of all market data by the Commission, all market data sharing agreements of the Commission, and all academic research performed at the Commission using market data. . 208. Subpoena duration and renewal Section 6(c)(5) of the Commodity Exchange Act ( 7 U.S.C. 9(5) ) is amended— (1) by striking (5) Subpoena.— For and inserting the following: (5) Subpoena (A) In general For