; (G) (i) a financial account number, debit card number, or credit card number of the consumer; or (ii) any passcode required to access an account described in clause (i); and (H) such additional information, as determined by the Director. 3. Cybersecurity standards and FTC authority (a) Establishment There is established in the Commission an Office of Cybersecurity, which shall be headed by a Director, who shall be a career appointee. (b) Duties The Office of Cybersecurity— (1) shall— (A) supervise covered consumer reporting agencies with respect to data security; (B) promulgate regulations for effective data security for covered consumer reporting agencies, including regulations that require covered consumer reporting agencies to— (i) provide the Commission with descriptions of technical and organizational security measures, including— (I) system and network security measures, including— (aa) asset management, including— (AA) an inventory of authorized and unauthorized devices; (BB) an inventory of authorized and unauthorized software, including application whitelisting; and (CC) secure configurations for hardware and software; (bb) network management and monitoring, including— (AA) mapped data flows, including functional mission mapping; (BB) maintenance, monitoring, and analysis of audit logs; (CC) network segmentation; and (DD) local and remote access privileges, defined and managed; and (cc) application management, including— (AA) continuous vulnerability assessment and remediation; (BB) server application hardening; (CC) vulnerability handling such as coordinated vulnerability disclosure policy; and (DD) patch management, including at, or near, real-time dashboards of patch implementation across network hosts; and (II) data security, including— (aa) data-centric security mechanisms such as format-preserving encryption, cryptographic data-splitting, and data-tagging and lineage; (bb) encryption for data at rest; (cc) encryption for data in transit; (dd) systemwide data minimization evaluations and policies