is included in the breach of security. (vi) A telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency. (vii) A telephone number, that an individual can use at no cost to the individual, and an Internet website address to obtain information from the Commission regarding identity theft. (3) Regulations and guidance (A) Regulations concerning substitute notification (i) In general Not later than 1 year after the date of enactment of this Act, the Commission shall prescribe criteria for determining circumstances under which notification may be provided under paragraph (2), including criteria for determining whether providing notification under paragraph (1) is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity. (ii) Other circumstances The regulations required by clause (i) may also identify other circumstances in which notification under paragraph (2) would be appropriate, including circumstances under which the cost of providing direct notification exceeds the benefits to individuals. (B) Guidance (i) In general The Commission, in consultation with the Administrator of the Small Business Administration, shall publish and otherwise make available general guidance with respect to compliance with this subsection. (ii) Contents The guidance required by clause (i) shall include the following: (I) A description of written or e-mail notification that complies with paragraph (1). (II) Guidance on the content of notification under paragraph (2), including the extent of notification to print and broadcast media that complies with subparagraph (B)(iii) of such paragraph. (e) Other obligations following breach (1) In general Subject to the provisions of this subsection, not later than 60 days after the date of a request by an individual who received notification under subsection (a)(1) and quarterly thereafter for 2 years, a covered entity required to