; and (2) ensure that a human factors specialist, separate from the research and certification groups, is directly involved with the NextGen approval process. (b) Report Not later than 1 year after the date of enactment of this Act, the Administrator shall submit to the appropriate committees of Congress a report on the progress made toward implementing the requirements under subsection (a). 508. Programmatic risk management To better inform the Administration's decisions regarding the prioritization of efforts and allocation of resources for NextGen, the Administrator shall— (1) solicit input from specialists in probability and statistics to identify and prioritize the programmatic and implementation risks to NextGen; and (2) develop a method to manage and mitigate the risks identified in paragraph (1). 509. Review of FAA strategic cybersecurity plan (a) In general Not later than 1 year after the date of enactment of this Act, the Administrator shall initiate a review of the comprehensive and strategic framework of principles and policies (referred to in this section as the framework ) developed pursuant to section 2111 of the FAA Extension, Safety, and Security Act of 2016 ( 49 U.S.C. 44903 note). (b) Contents In undertaking the review under subsection (a), the Administrator shall— (1) assess the degree to which the framework identifies and addresses known cybersecurity risks associated with the aviation system; (2) review existing short- and long-term objectives for addressing cybersecurity risks to the national airspace system