; and (ii) regularly testing or otherwise monitoring the effectiveness of the key controls, systems, and procedures of the safeguards. (E) A process for disposing of data containing personal information by shredding, permanently erasing, or otherwise modifying the personal information contained in such data to make such personal information permanently unreadable or undecipherable. (F) A process for overseeing persons to whom personal information is disclosed, or who have access to internet-connected devices, by— (i) taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the personal information or internet-connected devices at issue