; and (2) not later than 30 days after the commencement of such a waiver, submits a written justification to the relevant congressional committees that describes how such penetration tests would undermine national security or the diplomatic mission of the Department. (e) Incident reporting Not later than 180 days after the date of the enactment of this Act, and every 180 days thereafter for five years, the Secretary, in consultation with the Secretary of Defense, the Director of the National Intelligence, the Secretary of Homeland Security, and any other department or agency representative that the Secretary determines to be appropriate, shall securely submit a classified report to the relevant congressional committees that describes in detail— (1) for the first reporting period, all known and suspected incidents of the information systems specified in subsection (b) that occurred during the 180-day period immediately preceding the date of the enactment of this Act; and (2) for all subsequent reporting periods, all known and suspected incidents of the information systems specified in subsection (b) that occurred since the submission of the most recent report. (f) Contents Each report under subsection (e) shall include, for the relevant reporting period— (1) a description of the relevant information system, as specified in subsection (b), that experienced a known or suspected incident; (2) an assessment of the date and time each such incident occurred; (3) an assessment of the duration over which each such incident took place, including whether it is ongoing; (4) an assessment of the volume and sensitivity of information accessed, compromised, or potentially compromised by each incident, including any such information contained on information systems owned, operated, managed, or utilized by any other Federal department or agency; (5) an assessment of whether such information system was compromised by a malicious intrusion, including an assessment of— (A) the known or suspected perpetrators, including state actors