; and (F) assist the Office of Science and Technology Policy in publishing the annual report required under paragraph (2). (2) Report The Office of Science and Technology Policy shall develop and make publicly available an annual report on industry adoption rates and the effectiveness of the Framework. In preparing such report, the Office shall use information compiled by the public-private working group pursuant to paragraph (1)(D). 20B. Cybersecurity audits (a) Initial assessment (1) Requirement Not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , the Institute shall complete an initial assessment of the cybersecurity preparedness of the agencies described in paragraph (2). Such assessment shall be based on information security standards developed under section 20, and may also be informed by work done or reports published by other Federal agencies or officials. (2) Agencies The agencies referred to in paragraph (1) are the agencies referred to in section 901(b) of title 31, United States Code, and any other agency that has reported a major incident (as defined in the Office of Management and Budget Memorandum—16–03, published on October 30, 2015, or any successor document). (3) National security systems The requirement under paragraph (1) shall not apply to national security systems (as defined in section 3552(b) of title 44, United States Code). (b) Audits (1) Requirement Not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , the Institute shall initiate an individual cybersecurity audit of each agency described in subsection (a)(2), to assess the extent to which the agency is meeting the information security standards developed under section 20. (2) Relation to Framework Audits conducted under this subsection shall— (A) to the extent applicable and available, be informed by the report on agency adoption rates and the effectiveness of the Framework described in