; and (D) determining how a highly automated vehicle should respond to law enforcement. (b) Coordination of safety The Secretary, in coordination with State, local, and law enforcement agencies, may develop a process for State and local entities to provide information, on a voluntary basis, to the Secretary to assist the Department of Transportation in identifying defects related to motor vehicle safety of highly automated vehicles. (c) Crash data Not later than 3 years after the date of the enactment of this Act, the Secretary shall revise the crash investigation data collection system to include the collection of crash report data elements that distinguish whether the vehicle involved in a crash is a highly automated vehicle, including the level of automation and whether the vehicle was in automated mode at the time of a crash. 14. Cybersecurity (a) In general Subchapter I of chapter 301 of title 49, United States Code, as amended by section 9, is further amended by adding at the end the following: 30108. Cybersecurity risks to the safety of highly automated vehicles (a) Definitions In this section: (1) Cybersecurity incident The term cybersecurity incident has the meaning given the term incident in section 227(a) of the Homeland Security Act of 2002 ( 6 U.S.C. 148(a) ). (2) Cybersecurity risk The term cybersecurity risk has the meaning given the term in section 227(a) of the Homeland Security Act of 2002 ( 6 U.S.C. 148(a) ). (3) Cybersecurity vulnerability The term cybersecurity vulnerability has the meaning given the term security vulnerability in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ). (b) Cybersecurity plan (1) In general Each manufacturer of a highly automated vehicle or automated driving system shall develop, maintain, and execute a written plan for identifying and reducing cybersecurity risks to the motor vehicle safety of such vehicles and systems. (2) Requirements The plan required under paragraph (1) shall include a process for— (A) the risk-based