; and (II) regular testing or otherwise monitoring the effectiveness of the safeguards. (v) A process for determining if the covered information is no longer needed and deleting such covered information by shredding, permanently erasing, or otherwise modifying the covered information to make such covered information permanently unreadable or indecipherable. (vi) A process for overseeing persons (other than users of the children’s service) who have access to covered information, including through internet-connected devices, by— (I) taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the covered information or internet-connected devices at issue; and (II) requiring all such persons to implement and maintain such safeguards. (vii) A process for employee training and supervision for implementation of the policies, practices, and procedures required by this subsection. (viii) A written plan or protocol for internal and public response in the event of a breach of security. (C) Periodic assessment and consumer privacy and data security modernization An operator of a children’s service shall, not less frequently than every 12 months, monitor, evaluate, and adjust, as appropriate, the policies, practices, and procedures of such operator in light of any relevant changes in— (i) technology; (ii) internal or external threats and vulnerabilities to covered information