1. Short title This Act may be cited as the Data Accountability and Trust Act . 2. Requirements for information security (a) General security policies and procedures (1) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to require each covered entity to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information taking into consideration— (A) the size of, and the nature, scope, and complexity of the activities engaged in by such covered entity; (B) the sensitivity of any personal information at issue; (C) the current state of the art in administrative, technical, and physical safeguards for protecting such information