; and (B) not less frequently than annually on the quality and quantity of information such stakeholders receive through the mechanism established under such paragraph. (d) Cybersecurity (1) In general The Administrator, in consultation with the Secretary, shall— (A) not later than 120 days after the date of enactment of this Act, implement the Framework for Improving Critical Infrastructure Cybersecurity (referred to in this section as the Framework developed by the National Institute of Standards and Technology, and any update to such Framework under section 2 of the National Institute of Standards and Technology Act ( 15 U.S.C. 272 ), to manage the agency’s cybersecurity risks; and (B) evaluate, on a periodic basis, but not less often than biennially, the use of the Framework under subparagraph (A). (2) Cybersecurity enhancements to aviation security activities The Secretary, in consultation with the Secretary of Transportation, shall, upon request, conduct cybersecurity vulnerability assessments for airports and air carriers. (3) TSA trusted traveler and credentialing program cyber evaluation (A) Evaluation required Not later than 120 days after the date of enactment of this Act, the Secretary shall— (i) evaluate the cybersecurity of TSA trusted traveler and credentialing programs that contain personal information of specific individuals or information that identifies specific individuals, including the Transportation Worker Identification Credential and PreCheck programs; (ii) identify any cybersecurity risks under the programs described in clause (i)