; and (D) provide regular reports on cybersecurity risks. . (b) Continuous Diagnostics and Mitigation Strategy (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security shall develop a comprehensive continuous diagnostics and mitigation strategy to carry out the continuous diagnostics and mitigation program required under subsection (g) of section 230 of the Homeland Security Act of 2002 ( 6 U.S.C. 151 ), as added by subsection (a). (2) Scope The strategy required under paragraph (1) shall include the following: (A) A description of the continuous diagnostics and mitigation program, including efforts by the Secretary of Homeland Security to assist with the deployment of program tools, capabilities, and services, from the inception of the program referred to in paragraph (1) to the date of the enactment of this Act. (B) A description of the coordination required to deploy, install, and maintain the tools, capabilities, and services that the Secretary of Homeland Security determines to be necessary to satisfy the requirements of such program. (C) A description of any obstacles facing the deployment, installation, and maintenance of tools, capabilities, and services under such program. (D) Recommendations and guidelines to help maintain and continuously upgrade tools, capabilities, and services provided under such program. (E) Recommendations for using the data collected by such program for creating a common framework for data analytics, visualization of enterprise-wide risks, and real-time reporting. (F) Recommendations for future efforts and activities, including for the rollout of new tools, capabilities and services, proposed timelines for delivery, and whether to continue the use of phased rollout plans, related to securing networks, devices, data, and information technology assets through the use of such program. (3) Form The strategy required under subparagraph (A) shall be submitted in an unclassified form, but may contain a classified annex. (c)