; (BB) an inventory of software that is authorized by the covered consumer reporting agency to access data maintained by the covered consumer reporting agency, including application whitelisting; and (CC) secure configurations for hardware and software of the covered consumer reporting agency; (bb) network management and monitoring, including— (AA) mapped data flows, including functional mission mapping; (BB) maintenance, monitoring, and analysis of audit logs; (CC) network segmentation; and (DD) local and remote access privileges, defined and managed; and (cc) application management, including— (AA) continuous vulnerability assessment and remediation; (BB) server application hardening; (CC) vulnerability handling, such as coordinated vulnerability disclosure policy; and (DD) patch management, including at, or near, real-time dashboards of patch implementation across network hosts; and (II) data security measures, including— (aa) data-centric security mechanisms such as format-preserving encryption, cryptographic data-splitting, and data-tagging and lineage; (bb) encryption for data at rest; (cc) encryption for data in transit; (dd) systemwide data minimization evaluations and policies; and (ee) data recovery capability; (ii) employ reasonable technical measures and corporate governance processes for continuous monitoring of data, intrusion detection, and continuous evaluation and timely patching of vulnerabilities; (iii) employ reasonable technical measures and corporate governance processes that satisfy and exceed all relevant data security policy recommendations contained in the framework of the National Institute of Standards and Technology entitled Framework for Improving Critical Infrastructure Cybersecurity , dated February 12, 2014, or any successor thereto, as determined appropriate by the Office; and (iv) create and maintain documentation demonstrating that the covered consumer reporting agency is employing the technical measures and corporate governance processes described in clauses (ii) and (iii)