; and (ii) requiring all such persons to implement and maintain such security measures. (G) A process for employee training and supervision for implementation of the policies, practices, and procedures required by this subsection. (H) A written plan or protocol for internal and public response in the event of a breach of security. (3) Periodic assessment and consumer privacy and data security modernization Not less frequently than every 12 months, each covered entity shall monitor, evaluate, and adjust, as appropriate, the consumer privacy and data security program of such covered entity in light of any relevant changes in— (A) technology; (B) internal or external threats and vulnerabilities to personal information; and (C) the changing business arrangements of the covered entity, such as— (i) mergers and acquisitions; (ii) alliances and joint ventures; (iii) outsourcing arrangements; (iv) bankruptcy