; and (ii) the decision by the business entity to invoke the risk assessment exemption described under subparagraph (A). (C) Determination by Commission During the period beginning on the date on which the notification described in subparagraph (B) is submitted and ending 10 days after such date, the Commission has not issued a determination in writing that a notification should be provided under section 2. (2) Rebuttable presumption For purposes of paragraph (1)— (A) the rendering of sensitive personally identifiable information at issue unusable, unreadable, or indecipherable through a security technology generally accepted by experts in the field of information security shall establish a rebuttable presumption that such reasonable risk does not exist; and (B) any such presumption shall be rebuttable by facts demonstrating that the security technologies or methodologies in a specific case have been, or are reasonably likely to have been, compromised. (3) Risk assessment requirements A risk assessment is in accordance with this paragraph if the following requirements are met: (A) Properly conducted The risk assessment is conducted in a reasonable manner or according to standards generally accepted by experts in the field of information security. (B) Logging data required The risk assessment includes logging data, as applicable and to the extent available, for a period of at least six months before the discovery of a security breach described in section 2(a)— (i) for each communication or attempted communication with a database or data system containing sensitive personally identifiable information, the data system communication information for the communication or attempted communication, including any Internet addresses, and the date and time associated with the communication or attempted communication