; (B) designate 1 or more qualified employees to coordinate and be responsible for the Information Security Program; (C) not less frequently than once every 12 months, and promptly following a covered breach, assess and document internal and external risks to the security, confidentiality, or integrity of personal data that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such personal data; (D) design, implement, and document safeguards that— (i) address the internal and external risks to the security, confidentiality, or integrity of personal data that the covered entity identifies under subparagraph (C); and (ii) take into account the sensitivity of the personal data at issue; (E) not less frequently than once every 12 months, and promptly following a covered breach, assess the sufficiency of any safeguards in place to address the risks to the security, confidentiality, or integrity of personal data, which shall include an evaluation of safeguards in each area of relevant operation, including— (i) employee training and management; (ii) information systems, such as network and software design, information processing, storage, transmission, and disposal; and (iii) prevention, detection, and response to attacks, intrusions, or other system failures; and (F) (i) not less frequently than once every 12 months and promptly following a covered breach, test and monitor the effectiveness of the safeguards described in subparagraph (E); and (ii) modify the Information Security Program based on the results of testing and monitoring under clause (i). 2422. Civil penalties and damages for data breaches (a) Standard penalty (1) In general The Commission may issue an order to— (A) impose on a covered entity a civil penalty of $150 for each covered breach of the personal data of a person held by the covered entity