This part shall apply to breaches of security that are discovered on or after September 24, 2009.
16 C.F.R. §318.8