covered entity can be reasonably identified. Upon receiving such notification from a service provider, the covered entity shall be required to provide the notification and identity theft prevention and mitigation service required under subsection (a). (c) Timeliness of notification (1) In general All notifications and identity theft prevention and mitigation services required under this section shall be made as expediently as possible and without unreasonable delay following the discovery by the covered entity of a security breach. (2) Reasonable delay Reasonable delay under this subsection may include any reasonable time necessary to determine the scope of the security breach, prevent further disclosures, and provide notice to law enforcement when required. Except as provided in subsection (d), delay of notification or provision of identity theft prevention and mitigation service shall not exceed 7 days following the discovery of a security breach. (3) Burden of production The covered entity required to provide notice and identity theft prevention and mitigation service under this subtitle shall, upon the request of the Attorney General of the United States or the Federal Trade Commission provide records or other evidence of the notifications and identity theft prevention and mitigation service required under this subtitle, including to the extent applicable, the reasons for any delay of notification or provision of identity theft prevention and mitigation service. (d) Delay authorized for law enforcement or national security purposes (1) In general If a Federal law enforcement agency or intelligence agency determines that the notification or provision of identity theft prevention and mitigation service required under this section would impede a criminal investigation, or national security activity, such notification or provision of identity theft prevention and mitigation service, as the case may be, shall be delayed upon written notice from a Federal law enforcement agency or intelligence agency to the