1. Short title This Act may be cited as the Data Security and Breach Notification Act . 2. Requirements for information security (a) General security policies and procedures (1) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to require each covered entity that owns or possesses data containing personal information, or contracts to have any third-party entity maintain or process such data for such covered entity, to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information taking into consideration— (A) the size of, and the nature, scope, and complexity of the activities engaged in by such covered entity; (B) the current state of the art in administrative, technical, and physical safeguards for protecting such information; (C) the cost of implementing the safeguards under subparagraph (B)