; and (iv) create and maintain documentation demonstrating that the covered consumer reporting agency is employing the technical measures and corporate governance processes described in clauses (ii) and (iii); (C) annually examine the data security measures of covered consumer reporting agencies for compliance with the requirements described in clauses (ii) and (iii) of subparagraph (B); (D) investigate any covered consumer reporting agency if the Office has reason to suspect— (i) a covered breach has occurred and the covered consumer reporting agency was subject to the covered breach; or (ii) the covered consumer reporting agency is not in compliance with the requirements described in clauses (ii) and (iii) of subparagraph (B); (E) after consultation with members of the technical and academic communities, develop a rigorous, repeatable methodology— (i) for evaluating, testing, and measuring effective data security practices of covered consumer reporting agencies; and (ii) that employs forms of static and dynamic software analysis and penetration testing; (F) submit to Congress an annual report on the findings of each investigation carried out under subparagraph (D) during the year covered by the report that includes a statement of how Congress could enhance the authorities of the Office in order to assist the Office in carrying out the duties of the Office under this Act; (G) determine whether covered consumer reporting agencies are complying with the requirements described in clauses (ii) and (iii) of subparagraph (B); and (H) coordinate with the National Institute of Standards and Technology and the National Cybersecurity and Communications Integration Center of the Department of Homeland Security; and (2) may— (A) investigate any covered breach to determine if the covered consumer reporting agency that was subject to the covered breach was in compliance with the requirements described in clauses (ii) and (iii) of paragraph (1)(B) as of the date on which the covered breach occurred