; (B) review any plan or application forwarded under paragraph (2) ; (C) provide to the State and to the Secretary the recommendations of the Review Committee regarding the approval or disapproval of such plan or application and, if applicable, possible improvements to such plan or application; (D) provide to the Secretary an evaluation of any progress made by a State in implementing an active cyber resiliency plan using a prior biennial implementation grant; and (E) submit to Congress an annual report on the progress made in implementing active cyber resiliency plans. (4) Membership (A) Number and appointment The Review Committee shall be composed of 15 members appointed by the Secretary as follows: (i) At least 2 individuals recommended to the Secretary by the National Governors Association. (ii) At least 1 individual recommended to the Secretary by the National Association of State Chief Information Officers. (iii) At least 1 individual recommended to the Secretary by the National Guard Bureau. (iv) At least 1 individual recommended to the Secretary by the National Association of Counties. (v) At least 1 individual recommended to the Secretary by the National League of Cities. (vi) Not more than 9 other individuals who have educational and professional experience related to cybersecurity analysis or policy. (B) Terms Each member shall be appointed for a term of one year. Any member appointed to fill a vacancy occurring before the expiration of the term for which the member’s predecessor was appointed shall be appointed only for the remainder of that term. A member may serve after the expiration of that member’s term until a successor has taken office. A vacancy in the Commission shall be filled in the manner in which the original appointment was made. (C) Pay Members shall serve without pay. (D) Chairperson