; or (2) knowingly provide substantial assistance to any person, partnership, or corporation whose actions violate this Act. (b) Regulations (1) In general Not later than 2 years after the date of enactment of this section, the Commission shall promulgate regulations, in accordance with section 553 of title 5, United States Code, that— (A) require each covered entity to establish and implement reasonable cyber security and privacy policies, practices, and procedures to protect personal information used, stored, or shared by the covered entity from improper access, disclosure, exposure, or use; (B) require each covered entity to implement reasonable physical, technical, and organizational measures to ensure that technologies or products used, produced, sold, offered, or leased by the covered entity that the covered entity knows or has reason to believe store, process, or otherwise interact with personal information are built and function consistently with reasonable data protection practices; (C) require each covered entity to designate at least 1 employee who reports directly to an employee acting in an executive capacity in the covered entity, to coordinate its efforts to comply with and carry out its responsibilities under this Act, including any request or challenge related to the sharing of personal information; (D) require each covered entity to provide once per calendar year, at no cost, not later than 30 business days after receiving a written request from a verified consumer about whom the covered entity stores personal information— (i) a reasonable means to review any stored personal information of that verified consumer, including the manner in which the information was collected and the date of collection, in a form that is understandable to a reasonable consumer; (ii) a reasonable means to challenge the accuracy of any stored personal information of that verified consumer, including— (I) by providing publicly accessible contact information for any employee responsible for overseeing such a challenge