; (2) the Secretary of Defense and the Administrator of General Services regarding lessons that may be applied from existing vulnerability disclosure programs; and (3) non-governmental security researchers. (d) Public availability The Secretary shall make the policy developed under subsection (a) publicly available. (e) Submission to Congress (1) Not later than 90 days after the date of the enactment of this Act, the Secretary shall submit to Congress the policy required under subsection (a) and the remediation process required under subsection (b). (2) Not later than one year after creating the policy required under subsection (a) the Secretary shall submit a report to Congress, and annually thereafter for each of the next three years, the Secretary shall brief Congress with the following information with respect to the policy required under subsection (a) and the process required under subsection (b): (A) the number of unique security vul­ner­a­bil­i­ties reported; (B) the number of previously unknown security vulnerabilities mitigated or remediated; (C) the number of unique parties that reported security vulnerabilities; and (D) the average length of time between the reporting of security vulnerabilities and mitigation or remediation of such vul­ner­a­bil­i­ties. (f) Definitions In this section— (1) the term security vulnerability has the meaning given that term in section 1501 of title 6, United States Code, in information technology; and (2) the term information system has the meaning given that term by section 3502 of title 44, United States Code.