or network provided by the service provider for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, the service provider shall be required to promptly notify the covered entity who initiated such connection, transmission, routing, or storage of the security breach if the covered entity can be reasonably identified. Upon receiving such notification from a service provider, the covered entity shall be required to provide the notification required under subsection (a). (c) Timeliness of notification (1) In general All notifications required under this section shall be made as expediently as possible and without unreasonable delay following the discovery by the covered entity of a security breach. (2) Reasonable delay Reasonable delay under this subsection may include any reasonable time necessary to determine the scope of the security breach, prevent further disclosures, and provide notice to law enforcement when required. Except as provided in subsection (d), delay of notification shall not exceed 30 days following the discovery of a security breach. (3) Burden of production The covered entity required to provide notice under this subtitle shall, upon the request of the Attorney General of the United States or the Federal Trade Commission provide records or other evidence of the notifications required under this subtitle, including to the extent applicable, the reasons for any delay of notification. (d) Delay of notification authorized for law enforcement or national security purposes (1) In general If a Federal law enforcement agency or intelligence agency determines that the notification required under this section would impede a criminal investigation, or national security activity, such notification shall be delayed upon written notice from a Federal law enforcement agency or intelligence agency to the covered entity that experienced the security breach. The notification from a Federal law enforcement agency or intelligence agency shall specify in writing the