; and (2) provide recommendations to improve research and development on cabin-based cybersecurity vulnerabilities. (c) Report Not later than 9 months after the date of enactment of this Act, the Administrator shall transmit a report on the results of activities under this section to the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate. This report may contain classified annexes. 733. Cybersecurity threat modeling (a) Program (1) In general The Administrator shall consult the National Institute of Standards and Technology to research and develop an internal FAA cybersecurity threat modeling program to detect cybersecurity vulnerabilities, track how those vulnerabilities might be exploited, and assess the magnitude of harm that could be caused by the exploitation of those vulnerabilities. (2) Updates This program shall be updated regularly, not less than once every 5 years. (b) Report Not later than one year after the date of enactment of this Act, and within 7 days of each threat modeling program update under subsection (a)(2), the Administrator shall transmit a report to the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate detailing the status, results, and composition of the threat modeling program. 734. National Institute of Standards and Technology cybersecurity standards Not later than 6 months after the date of enactment of this Act, the FAA shall, in consultation with the National Institute of Standards and Technology, transmit to the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report that includes— (1) a cybersecurity standards plan to implement National Institute of Standards and Technology revisions to cybersecurity guidance documents within timeframes set by the Office of Management and Budget