one year after establishing the policy required under subsection (a), the Secretary of Homeland Security shall submit to the appropriate congressional committees a report on such policy and the remediation process required under subsection (b). (B) Annual briefings One year after the date of the submission of the report under subparagraph (A), and annually thereafter for each of the next three years, the Secretary of Homeland Security shall provide to the appropriate congressional committees a briefing on the policy required under subsection (a) and the process required under subsection (b). (C) Matters for inclusion The report required under subparagraph (A) and the briefings required under subparagraph (B) shall include each of the following with respect to the policy required under subsection (a) and the process required under subsection (b) for the period covered by the report or briefing, as the case may be: (i) The number of unique security vulnerabilities reported. (ii) The number of previously unknown security vulnerabilities mitigated or remediated. (iii) The number of unique individuals, organizations, and companies that reported security vulnerabilities. (iv) The average length of time between the reporting of security vulnerabilities and mitigation or remediation of such vulnerabilities. (f) Definitions In this section: (1) The term security vulnerability has the meaning given that term in section 102(17) of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501(17) ), in information technology. (2) The term information system has the meaning given that term by section 3502 of title 44, United States Code. (3) The term appropriate information system means an information system that the Secretary of Homeland Security selects for inclusion under the vulnerability disclosure policy required by subsection (a). (4) The term appropriate congressional committees means— (A) the Committee on Homeland Security, the Committee on Armed Services, the Committee on Energy and Commerce, and the Permanent