; and (D) the impact on small businesses and nonprofits. (2) Requirements The regulations shall require the policies and procedures to include the following: (A) A security policy with respect to the collection, use, sale, other dissemination, and maintenance of personal information. (B) The identification of an officer or other individual as the point of contact with responsibility for the management of information security. (C) A process for identifying and assessing any reasonably foreseeable vulnerabilities in each system maintained by the covered entity that contains such personal information, including regular monitoring for a breach of security of each such system. (D) A process for taking preventive and corrective action to mitigate any vulnerabilities identified in the process required by subparagraph (C), that may include implementing any changes to information security practices and the architecture, installation, or implementation of network or operating software. (E) A process for disposing of data in electronic form containing personal information by destroying, permanently erasing, or otherwise modifying the personal information contained in such data to make such personal information permanently unreadable or indecipherable. (F) A standard method or methods for the destruction of paper documents and other non-electronic data containing personal information. (b) Limitations (1) Covered entities subject to the Gramm-Leach-Bliley Act A financial institution that is subject to title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq.) and is in compliance with information security requirements under that Act shall be deemed in compliance with this section. (2) Applicability of other information security requirements A person who is subject to, and in compliance with, the information security requirements of section 13401 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 ) or of section 1173(d) of title XI, part C of the Social Security Act ( 42 U.S.C.