; potential revision (1) Review Not later than 90 days after the date of the enactment of this Act, the Commission shall complete a review of the standards contained in the regulations issued by the Commission under section 501 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 ) to determine whether such standards require covered consumer reporting agencies and covered service providers to maintain sufficient safeguards to protect customer records and information against cyber attacks and related threats. (2) Revision If the Commission determines in the review completed under paragraph (1) that the standards contained in the regulations issued by the Commission under section 501 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 ) do not require covered consumer reporting agencies and covered service providers to maintain sufficient safeguards to protect customer records and information against cyber attacks and related threats, not later than 180 days after the date of the completion of the review, the Commission shall, pursuant to section 553 of title 5, United States Code, revise such regulations so as to provide for standards applicable to covered consumer reporting agencies and covered service providers that require such agencies and providers to maintain sufficient safeguards to protect customer records and information against cyber attacks and related threats. (b) Investigations (1) Initial investigation (A) In general Not later than 18 months after the date described in subparagraph (B), the Commission shall complete an investigation of each person or entity that, as of the date described in such subparagraph, is a covered consumer reporting agency or covered service provider, to determine whether such agency or provider is in compliance with the regulations issued by the Commission under section 501 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 ). (B) Date described The date described in this subparagraph is— (i) if no revision of such regulations is required by paragraph (2) of subsection (a), the date of the