promulgate regulations through notice-and-comment rulemaking to require State agencies to take the security measures described in the guidance issued under paragraph (1);