and accounts of such employees and their families, including an assessment of the purposes of such efforts and their degrees of success. (3) An assessment of the actions taken by the department or agency to educate employees and their families, including particularly vulnerable subpopulations, about and actions that can be taken to otherwise reduce these threats. (4) Assessment of the potential for the cy­ber­ex­ploi­ta­tion of misappropriated images and videos as well as deep fakes. (5) Development of recommendations for policy changes to reduce the vulnerability of such employees and their families to cyberexploitation, including recommendations for legislative or administrative action. (d) Report (1) In general Each head of a covered department shall submit to Congress a report on the findings of the head with respect to the study conducted by the head under subsection (b). (2) Form The report required by paragraph (1) shall be submitted in unclassified form, but may include a classified annex.