and procedures required by this section. (7) A written plan or protocol for internal and public response in the event of a data breach or data-sharing abuse. (c) Regulations The Director, in consultation with the Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology, shall promulgate regulations to implement this section. (d) Small businesses assistance The Director, in consultation with the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology, the Small Business Administration, the Minority Business Development Agency, and small businesses, shall develop policy templates, toolkits, tip sheets, configuration guidelines for commonly used hardware and software, interactive tools, and other materials to assist small businesses with complying with this section. 213. Notification of data breach or data-sharing abuse (a) Notification of agency (1) In general In the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity, such covered entity shall, without undue delay and, if feasible, not later than 72 hours after becoming aware of such data breach or data-sharing abuse, notify the Director of such data breach or data-sharing abuse, unless such data breach or data-sharing abuse is unlikely to create or increase foreseeable privacy harms. (2) Reasons for delay If the notification required by paragraph (1) is made more than 72 hours after the covered entity becomes aware of the data breach or data-sharing abuse, such notification shall be accompanied by a statement of the reasons for the delay. (b) Notification of other covered entity In the case of a data breach or data-sharing abuse with respect to personal information maintained by a covered entity that such covered entity obtained from another covered entity, the covered entity experiencing such data breach or data-sharing abuse shall, without undue delay and, if feasible, not later than 72 hours after becoming