; and (II) is not at substantial risk of meeting such criteria. (C) Regulations Not later than 90 days after the date of the enactment of this Act, the Secretary of State shall prescribe regulations— (i) establishing a process for a covered technology company or country of concern to petition the Secretary to remove the country of concern designation from a country that was designated as such pursuant to subparagraph (B)(ii); and (ii) setting forth the procedures and criteria the Secretary will use in identifying or removing countries under subparagraphs (A)(iii) or (B)(iii). (3) Covered technology company The term covered technology company means an entity that provides an online data-based service such as a website or internet application in or affecting interstate or foreign commerce and— (A) is organized under the laws of a country of concern; (B) in which foreign persons that are nationals of, or companies that are organized under the laws of, countries of concern have a plurality or controlling equity interest; (C) is a subsidiary company of an entity described in subparagraph (A) or (B)