on an ongoing basis existing and emerging security threats to the website. (8) State The term State means each State of the United States, the District of Columbia, each territory or possession of the United States, and each federally recognized Indian tribe. 3. Privacy breach requirements (a) Information security amendment Subchapter II of chapter 35 of title 44, United States Code, is amended by adding at the end the following: 3559. Privacy breach requirements (a) Policies and Procedures The Director of the Office of Management and Budget shall establish and oversee policies and procedures for agencies to follow in the event of a breach of information security involving the disclosure of personally identifiable information, including requirements for— (1) not later than 72 hours after the agency discovers such a breach, or discovers evidence that reasonably indicates such a breach has occurred, notice to the individuals whose personally identifiable information could be compromised as a result of such breach