; (D) recommend other procedures for compliance with cybersecurity reporting, oversight, and policy review and creation requirements under such chapter 35 and any other applicable Federal law; and (E) be updated, as the Institute considers necessary, to reflect what the Institute learns from ongoing research, the audits conducted pursuant to section 20B(b), the information compiled by the Federal working group established pursuant to paragraph (3), the information compiled by the public-private working group established pursuant to subsection (b)(1), the annual reports published pursuant to paragraph (4), and the annual reports published pursuant to subsection (b)(2). (3) Federal working group Not later than 3 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , the Institute shall establish and chair a working group (in this section referred to as the Federal working group ), including representatives of the Office of Science and Technology Policy and other appropriate Federal agencies, which shall— (A) not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , develop outcome-based and quantifiable metrics, in coordination with the public-private working group established pursuant to subsection (b), to help Federal agencies in their analysis and assessment of the effectiveness of the Framework in protecting their information and information systems; (B) update such metrics as the Federal working group considers necessary; (C) compile information from Federal agencies on their use of the Framework and the results of the analysis and assessment described in subparagraph (A)