; (II) security requirements that are consistent with the Federal agency responsibilities in section 3554 of title 44, United States Code, or any relevant successor of such responsibilities; and (III) security requirements, guidelines, and controls consistent with cybersecurity standards and best practices developed by the National Institute of Standards and Technology, including frameworks, consistent with section 2(c) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(c) ), or any relevant successor of such frameworks; (v) follow Federal data minimization practices to ensure only the minimum amount of data is collected to meet the system’s goals, in accordance with Federal data minimization standards and guidelines developed by the National Institute of Standards and Technology; and (vi) provide notice to students outlining the data included in the system and how the data are used. (2) Data elements (A) In general Not later than 4 years after the date of enactment of the Lowering Education Costs and Debt Act , the Commissioner, in consultation with the Postsecondary Student Data System Advisory Committee established under subparagraph (B), shall determine— (i) the data elements to be included in the postsecondary student data system, in accordance with subparagraphs (C) and (D); and (ii) how to include the data elements required under subparagraph (C), and any additional data elements selected under subparagraph (D), in the postsecondary student data system. (B) Postsecondary student data system advisory committee (i) Establishment Not later than 2 years after the date of enactment of the Lowering Education Costs and Debt Act , the Commissioner shall establish a Postsecondary Student Data System Advisory Committee (referred to in this subsection as the Advisory Committee ), whose members shall include— (I) the Chief Privacy Officer of the Department or an official of the Department delegated the duties of overseeing data privacy at the Department