unreasonable delay and, if it will not delay notice to the affected individuals, prior to the distribution of notices to the affected individuals. (c) Timeliness of notification (1) In general All notifications required under this section shall be made without unreasonable delay following the discovery by the covered entity of a security breach. (2) Reasonable delay (A) In general Reasonable delay under this subsection may include any time necessary to determine the scope of the security breach, prevent further disclosures, restore the reasonable integrity of the data system, and provide notice to law enforcement when required. (B) Extension (i) In general Except as provided in subsection (d), delay of notification shall not exceed 60 days following the discovery of the security breach, unless the covered entity requests an extension of time and the Commission determines in writing that additional time is reasonably necessary to determine the scope of the security breach, prevent further disclosures, restore the reasonable integrity of the data system, or to provide notice to the designated entity. (ii) Approval of request If the Commission approves the request for delay, the covered entity may delay the period for notification for additional periods of up to 30 days. (3) Burden of production The covered entity, third party, or service provider required to provide notice under this title shall, upon the request of the Commission provide records or other evidence of the notifications required under this subtitle, including to the extent applicable, the reasons for any delay of notification. (d) Method and content of notification (1) Direct notification (A) Method of direct notification Except as provided in paragraph (2), a covered entity shall be in compliance with the notification requirement under subsection (a)(1) if— (i) the covered entity provides conspicuous and clearly identified notification— (I) in writing