; and (B) if the agency is required by law or Executive order to adopt the Framework, be based on the guidance described in section 20A(a)(2) and metrics developed under section 20A(a)(3)(A). (3) Schedule The Institute shall establish a schedule for completion of audits under this subsection to ensure that— (A) audits of agencies whose information security risk is high, based on the assessment conducted under subsection (a), are completed not later than 1 year after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , and are audited annually thereafter; and (B) audits of all other agencies described in subsection (a)(2) are completed not later than 2 years after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , and are audited biennially thereafter. (4) Report A report of each audit conducted under this subsection shall be transmitted by the Institute to— (A) the Office of Management and Budget; (B) the Office of Science and Technology Policy; (C) the Government Accountability Office; (D) the agency being audited; (E) the Inspector General of such agency, if there is one; and (F) Congress, including the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate. .