; (ii) a description of each type of personal information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security; (iii) notice that an individual may be entitled to consumer credit reports under subsection (e)(1); (iv) instructions how an individual can request consumer credit reports under subsection (e)(1); (v) a telephone number that an individual can use at no cost to the individual to contact the covered entity to inquire about the breach of security or the information the covered entity maintained or possessed about that individual; (vi) a telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency; and (vii) a telephone number, that an individual can use at no cost to the individual, and an Internet Web site address to obtain information regarding identity theft from the Commission. (3) Regulations and guidance (A) Regulations Not later than 1 year after the date of enactment of this Act, the Commission, by regulation under section 553 of title 5, United States Code, shall establish criteria for determining circumstances under which substitute notification may be provided under paragraph (2), including criteria for determining if direct notification under paragraph (1) is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity. The regulations may also identify other circumstances where substitute notification would be appropriate, including circumstances under which the cost of providing direct notification exceeds the benefits to consumers. (B) Guidance In addition, the Commission, in consultation with the Small Business Administration, shall provide and publish general guidance with respect to compliance with this subsection. The guidance shall include— (i) a description of written or e-mail notification that complies with paragraph (1)