; (B) the sensitivity of any personal information at issue; (C) the current state of the art in administrative, technical, and physical safeguards for protecting such information; and (D) the cost of implementing such safeguards. (2) Requirements Such regulations shall require the policies and procedures to include the following: (A) A written security policy with respect to the collection, use, sale, other dissemination, and maintenance of such personal information. (B) The identification of an officer or other individual as the point of contact with responsibility for the management of information security. (C) A process for identifying and assessing any reasonably foreseeable vulnerabilities in the system or systems maintained by such covered entity that contains such data, which shall include regular monitoring for a breach of security of such system or systems. (D) A process for taking preventive and corrective action to mitigate against any vul­ner­a­bil­i­ties identified in the process required by subparagraph (C), which may include implementing any changes to security practices and the architecture, installation, or implementation of network or operating software, and for regularly testing or otherwise monitoring the effectiveness of the safeguards’ key controls, systems, and procedures. (E) A process for disposing of data containing personal information by shredding, permanently erasing, or otherwise modifying the personal information contained in such data to make such personal information permanently unreadable or undecipherable. (F) A process for overseeing persons to whom personal information is disclosed, or who have access to internet-connected devices, by— (i) taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the personal information or internet-connected devices at issue