; (ii) the sensitivity of any covered information at issue; (iii) the state of the art in administrative, technical, and physical safeguards for protecting such information; and (iv) the cost of implementing such policies, practices, and procedures. (B) Specific requirements Such regulations shall require the policies, practices, and procedures established pursuant to regulations issued under subparagraph (A) to include the following: (i) A written security policy with respect to the processing of such covered information. (ii) The identification of an officer or other individual as the point of contact with responsibility for the management of information security. (iii) A process for identifying and assessing any reasonably foreseeable vulnerabilities in the system or systems maintained by such covered entity that contains such covered information, including regular monitoring for a breach of security of such system or systems. (iv) A process for taking preventive and corrective action to mitigate against any vulnerabilities identified in the process required by clause (iii), which may include— (I) implementing any changes to the security practices, architecture, installation, or implementation of network or operating software; and (II) regular testing or otherwise monitoring the effectiveness of the safeguards. (v) A process for determining if the covered information is no longer needed and deleting such covered information by shredding, permanently erasing, or otherwise modifying the covered information contained in such data to make such covered information permanently unreadable or indecipherable. (vi) A process for overseeing persons who have access to covered information, including through Internet-connected devices, by— (I) taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the covered information or Internet-connected devices at issue