; and (II) requiring all such persons to implement and maintain such security measures. (vii) A process for employee training and supervision for implementation of the policies, practices, and procedures required by this subsection. (viii) A written plan or protocol for internal and public response in the event of a breach of security. (C) Periodic assessment and consume privacy and data security modernization Such regulations shall require a covered entity, not less frequently than every 12 months, to monitor, evaluate, and adjust, as appropriate, the policies, practices, and procedures of such covered entity in light of any relevant changes in— (i) technology; (ii) internal or external threats and vulnerabilities to covered information; and (iii) the changing business arrangements of the covered entity. (D) Submission of policies to the FTC Such regulations shall require a covered entity to submit the policies, practices, and procedures of the covered entity to the Commission in conjunction with a notification of a breach of security required by any Federal or State statute or regulation or upon request of the Commission. ; and (4) in subsection (c)— (A) by inserting subsection (a)(2) or after violation of ; and (B) by striking under subsection (a) and inserting under subsection (b) . 4. Repeal of safe harbors provision and conforming amendments (a) In general Section 1304 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6503 ) is repealed. (b) Conforming amendments The Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6501 et seq.) is amended— (1) by striking operator each place it appears and inserting covered entity ; (2) in section 1303(c), by striking sections 1304 and 1306 and inserting section 1306