; and (2) require the person or entity by contract to implement and maintain appropriate measures designed to meet the objectives and requirements governing subtitle A. (e) Periodic assessment and consumer privacy and data security modernization Each covered entity subject to this subtitle shall on a regular basis monitor, evaluate, and adjust, as appropriate its consumer privacy and data security program in light of any relevant changes in— (1) technology; (2) internal or external threats and vulnerabilities to sensitive personally identifiable information; and (3) the changing business arrangements of the covered entity, such as— (A) mergers and acquisitions; (B) alliances and joint ventures; (C) outsourcing arrangements; (D) bankruptcy