; and (2) take reasonable steps to protect confidential Federal and State information from unauthorized disclosure. (h) Duty To assess possible cybersecurity incidents (1) Election agencies If an election agency becomes aware of the possibility of an election cybersecurity incident, the election agency shall promptly assess whether an election cybersecurity incident occurred and notify the State election official. (2) Election service providers If an election service provider becomes aware of the possibility of an election cybersecurity incident, the election service provider shall promptly assess whether an election cybersecurity incident occurred and notify the relevant election agencies consistent with subsection (j). (i) Information sharing about cybersecurity incidents by election agencies If an election agency has reason to believe that an election cybersecurity incident has occurred with respect to an election system owned, operated, or maintained by or on behalf of the election agency, the election agency shall, in the most expedient time possible and without unreasonable delay (in no event longer than 3 calendar days after discovery of the incident), provide notification of the election cybersecurity incident to the Secretary. (j) Information sharing about cybersecurity incidents by election service providers If an election service provider has reason to believe that an election cybersecurity incident may have occurred, or that an information security incident related to the role of the provider as an election service provider may have occurred, the election service provider shall— (1) notify the relevant election agencies in the most expedient time possible and without unreasonable delay (in no event longer than 3 calendar days after discovery of the possible incident)