Covered entities should begin to determine how the Part 500 updates may affect existing licenses or applications currently under review. In particular, covered entities should:

• Determine whether they fall under the definition of a “Class A Company.”
• Update documentation to account for new policy and procedure requirements.
• Examine their cybersecurity governance structure to ensure that their CISOs and senior governing bodies have the capabilities and resources to manage the cybersecurity program and report on material issues as needed.