CVS Caremark must implement an information security program and obtain assessments of its effectiveness every other year for 20 years to settle federal charges.