; (B) an agency-wide risk management framework for information security; (C) a description of the information security system management controls and common controls that are necessary to ensure compliance with information security-related requirements; (D) an identification and assignment of roles, responsibilities, and management commitment for information security at the agency; (E) coordination among organizational entities, including between each center, facility, mission directorate, and mission support office, and among agency entities responsible for different aspects of information security; (F) the need to protect the information security of mission-critical systems and activities and high-impact and moderate-impact information systems; and (G) a schedule of frequent reviews and updates, as necessary, of the plan. 814. Security management of foreign national access The Administrator shall notify the appropriate committees of Congress when the agency has implemented the information technology security recommendations from the National Academy of Public Administration on foreign national access management, based on reports from January 2014 and March 2016. 815. Cybersecurity of web applications Not later than 180 days after the date of enactment of this Act, the Administrator shall, in a manner that reflects the unique nature of NASA's mission and expertise— (1) develop a plan, including such actions and milestones as are necessary, to fully remediate security vulnerabilities of NASA web applications within a timely fashion after discovery