; and (ii) the security technology or methodology under clause (i) is generally accepted by experts in the information security field. (B) Rebuttal The presumption under subparagraph (A) may be rebutted by facts demonstrating that the security technology or methodology in a specific case has been or is reasonably likely to be compromised. (3) Technologies or methodologies Not later than 1 year after the date of enactment of this Act, and biennially thereafter, the Commission, after consultation with the National Institute of Standards and Technology, shall issue rules (pursuant to section 553 of title 5, United States Code) or guidance to identify each security technology and methodology under paragraph (2). In identifying each such security technology and methodology, the Commission and the National Institute of Standards and Technology shall— (A) consult with relevant industries, consumer organizations, data security and identity theft prevention experts, and established standards setting bodies; and (B) consider whether and in what circumstances a security technology or methodology currently in use, such as encryption, complies with the standards under paragraph (2). (4) Commission guidance Not later than 1 year after the date of enactment of this Act, the Commission, after consultation with the National Institute of Standards and Technology, shall issue guidance regarding the application of the exemption under paragraph (1). (h) Exemptions for national security and law enforcement purposes (1) In general A covered entity shall be exempt from the requirements under this section if— (A) a determination is made— (i) by the United States Secret Service or the Federal Bureau of Investigation that notification of the breach of security could be reasonably expected to reveal sensitive sources and methods or similarly impede the ability of the Government to conduct law enforcement or intelligence investigations