; (B) protect against any anticipated vulnerabilities to the privacy and security of sensitive personally identifying information; and (C) protect against unauthorized access, destruction, acquisition, disclosure, or use of sensitive personally identifying information. (3) Risk assessment A covered entity shall— (A) identify reasonably foreseeable internal and external vulnerabilities and internal and external threats that could result in unauthorized access, destruction, acquisition, disclosure, or use of sensitive personally identifiable information or of systems containing sensitive personally identifiable information; (B) assess the likelihood of and potential damage from unauthorized access, destruction, acquisition, disclosure, or use of sensitive personally identifiable information; (C) assess the sufficiency of its technical, physical, and administrative controls in place to control and minimize risks from unauthorized access, destruction, acquisition, disclosure, or use of sensitive personally identifiable information; and (D) assess the vulnerability of sensitive personally identifiable information during destruction and disposal of such information, including through the disposal or retirement of hardware. (4) Risk management and control Each covered entity shall— (A) design its consumer privacy and data security program to control the risks identified under paragraph (3); (B) adopt measures commensurate with the sensitivity of the data as well as the size, complexity, nature, and scope of the activities of the covered entity that— (i) controls access to sensitive personally identifiable information, including controls to authenticate and permit access only to authorized individuals; (ii) detect, record, and preserve information relevant to actual and attempted fraudulent, unlawful, or unauthorized access, acquisition, disclosure, or use of sensitive personally identifiable information, including by employees and other individuals otherwise authorized to have access