A year after the massive Equifax data breach was revealed, Congress and federal agencies are stuck in neutral when it comes to writing a policy response that would address cybersecurity requirements for consumer credit agencies, including breach-notice and related issues.

The hack at Equifax, which exposed Social Security numbers and other sensitive information on approximately 150 million Americans, raised an array of policy questions including: what’s a reasonable lag between discovering a hack and notifying the public; and how do you compel firms to apply available patches for known vulnerabilities?