The DOJ has issued guidance to facilitate compliance with its final rules, referred to as the Data Security Program (DSP), implementing former President Biden’s Executive Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern. Though much of the guidance material rearticulates language in the DSP, there was some notable new compliance information for organizations. This two-part article series highlights the key elements of the guidance, with commentary from Edward McNicholas, a partner at Ropes & Gray. The first installment covered the enforcement grace period, definitions of bulk data and covered persons, and prohibited transactions. Part two distilled guidance on DSP requirements around the data compliance program, recordkeeping, reporting, licenses and advisory opinions.