; (2) the nature and scope of the activities of the covered entity or service provider; (3) the technical feasibility and cost of available tools, external audits or assessments, and other measures used by the covered entity or service provider to improve security and reduce vulnerabilities; (4) the sensitivity of the personal data involved; and (5) the potential for unauthorized access, use, destruction, acquisition, modification, or disclosure of the personal data involved to result in economic loss, identity theft, fraud, or physical injury to the individuals to whom such data relates. (c) Requirements for program A comprehensive data security program under this section shall be designed to, at a minimum— (1) designate an employee or employees to be responsible for overseeing and maintaining its safeguards; (2) identify material internal and external risks to the security and confidentiality of personal data and assess the sufficiency of any safeguards in place to control these risks, including consideration of risks in each relevant area of the operations of the covered entity or service provider, including— (A) employee training and management; (B) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; (C) detecting, preventing, and responding to attacks, intrusions, or other systems failures; and (D) whether the covered entity or service provider has taken action to address and prevent reasonably known and addressable security vulnerabilities; (3) implement safeguards designed to control the risks identified in the covered entity's or service provider's risk assessment, and regularly assess the effectiveness of those safeguards