The regulation requires covered entities to assess risks associated with their information systems and establish and maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of such systems and data.