; (B) update such metrics as the Federal working group considers necessary; (C) compile information from Federal agencies on their use of the Framework and the results of the analysis and assessment described in subparagraph (A); and (D) assist the Office of Science and Technology Policy in publishing the annual report required under paragraph (4). (4) Report The Office of Science and Technology Policy shall develop and make publicly available an annual report on agency adoption rates and the effectiveness of the Framework. In preparing such report, the Office shall use the information compiled by the Federal working group pursuant to paragraph (3)(C). (b) Implementation by private entities (1) Public-private working group Not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , the Institute shall, in coordination with industry stakeholders, establish a working group (in this section referred to as the public-private working group ) which shall— (A) not later than 1 year after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , develop specific Framework implementation models and measurement tools that private entities can use to adopt the Framework; (B) not later than 1 year after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , develop, in coordination with the Federal working group, industry-led, consensus and outcome-based metrics that quantify the effectiveness and benefits of the Framework to enable private entities to voluntarily analyze and assess their individual corporate cybersecurity risks; (C) update the models and tools developed pursuant to subparagraph (A) and the metrics developed pursuant to subparagraph (B), as the public-private working group considers necessary