; and (4) the cost of implementing such administrative, technical, and physical safeguards. (b) Specific policies, practices, and procedures The policies, practices, and procedures required by subsection (a) shall include the following: (1) A written security policy with respect to collecting, processing, maintaining, and disclosing of personal information. Such policy shall be made publicly available in a prominent location on an ongoing basis, except that the publicly available version is not required to contain information that would compromise a purpose described in section 109(a)(1). (2) A process for identifying and assessing reasonably foreseeable security vulnerabilities in the system or systems used by such covered entity that contain personal information, which shall include regular monitoring for vulnerabilities or data breaches involving such system or systems. (3) A process for taking action designed to mitigate against vulnerabilities identified in the process required by paragraph (2), which may include implementing any changes to security practices and the architecture, installation, or implementation of network or operating software, or for regularly testing or otherwise monitoring the effectiveness of the existing safeguards. (4) A process for determining if personal information is no longer needed and disposing of personal information by shredding, permanently erasing, or otherwise modifying the medium on which such personal information is maintained to make such personal information permanently unreadable or indecipherable. (5) A process for overseeing persons who have access to personal information, including through network-connected devices. (6) A process for employee training and supervision for implementation of the policies, practices, and procedures required by this section. (7) A written plan or protocol for internal and public response in the event of a data breach or data-sharing abuse. (c) Regulations The Director, in consultation with the Cybersecurity and Infrastructure Security