; and (B) be treated in a manner consistent with privacy concerns. 604. Reports on the vulnerabilities equities policy and process of the Federal Government (a) Report policy and process (1) In general Not later than 90 days after the date of the enactment of this Act and not later than 30 days after any substantive change in policy, the head of each element of the intelligence community shall submit to the congressional intelligence committees a report detailing the process and criteria the head uses for determining whether to submit a vulnerability for review under the vulnerabilities equities policy and process of the Federal Government. (2) Form Each report submitted under paragraph (1) shall be submitted in unclassified form, but may include a classified annex. (b) Annual report on vulnerabilities (1) In general Not less frequently than once each year, the Director of National Intelligence shall submit to the congressional intelligence committees a report on— (A) how many vulnerabilities the intelligence community has submitted for review during the previous calendar year; (B) how many of such vulnerabilities were ultimately disclosed to the vendor responsible for correcting the vulnerability during the previous calendar year; and (C) vulnerabilities disclosed since the previous report that have either— (i) been patched or mitigated by the responsible vendor