1. Short title This Act may be cited as the Data Accountability and Trust Act . 2. Requirements for information security (a) General security policies and procedures (1) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, that require each covered entity to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information taking into consideration— (A) the size of and the nature, scope, and complexity of the activities engaged in by such covered entity; (B) the sensitivity of any personal information at issue; (C) the current state of the art in administrative, technical, and physical safeguards for protecting such information; and (D) the cost of implementing such safeguards. (2) Requirements The regulations required pursuant to paragraph (1) shall include a requirement that the policies and procedures include the following: (A) A written security policy with respect to the collection, use, sale, other dissemination, and maintenance of the personal information. (B) The identification of an officer or other individual as the point of contact with responsibility for the management of information security. (C) A process for identifying and assessing any reasonably foreseeable vulnerability in any system maintained by the covered entity that contains such data, including regular monitoring for a breach of security of any such system. (D) A process for— (i) taking preventive and corrective action to mitigate against any vulnerability identified in the process required by subparagraph (C), which may include implementing any changes to security practices and the architecture, installation, or implementation of network or operating software