; and (B) establishment of a simple process under which a covered entity that is a small business or small nonprofit organization may request a full or a partial waiver or a modified or an alternative means of complying with this subsection if providing free consumer credit reports is not feasible due to excessive costs relative to the resources of such covered entity and relative to the level of harm, to affected individuals, caused by the breach of security. (f) Delay of Notification Authorized for National Security and Law Enforcement Purposes (1) In general If the United States Secret Service or the Federal Bureau of Investigation determines that notification under this section would impede a criminal investigation or a national security activity, notification shall be delayed upon written notice from the United States Secret Service or the Federal Bureau of Investigation to the covered entity that experienced the breach of security. Written notice from the United States Secret Service or the Federal Bureau of Investigation shall specify the period of delay requested for national security or law enforcement purposes. (2) Subsequent delay of notification (A) In general A covered entity shall provide notification under this section not later than 30 days after the day that the delay was invoked unless a Federal law enforcement or intelligence agency provides subsequent written notice to the covered entity that further delay is necessary. (B) Written justification requirements (i) United States Secret Service If the United States Secret Service instructs a covered entity to delay notification under this section beyond the 30-day period under subparagraph (A) (referred to in this clause as subsequent delay ), the United States Secret Service shall submit written justification for the subsequent delay to the Secretary of Homeland Security before the subsequent delay begins. (ii) Federal Bureau of Investigation If the Federal Bureau of Investigation instructs a covered entity to delay notification under this