; and (ii) the process used by such element to make such determination; and (B) the roles or responsibilities of that element during a review of a vulnerability submitted to the Vulnerabilities Equities Process. (2) Changes to process or criteria Not later than 30 days after any significant change is made to the process and criteria used by any element of the intelligence community for determining whether to submit a vulnerability for review under the Vulnerabilities Equities Process, such element shall submit to the congressional intelligence committees a report describing such change. (3) Form of reports Each report submitted under this subsection shall be submitted in unclassified form, but may include a classified annex. (b) Annual reports (1) In general Not less frequently than once each calendar year, the Director of National Intelligence shall submit to the congressional intelligence committees a classified report containing, with respect to the previous year— (A) the number of vulnerabilities submitted for review under the Vulnerabilities Equities Process; (B) the number of vulnerabilities described in subparagraph (A) disclosed to each vendor responsible for correcting the vulnerability, or to the public, pursuant to the Vulnerabilities Equities Process; and (C) the aggregate number, by category, of the vulnerabilities excluded from review under the Vulnerabilities Equities Process, as described in paragraph 5.4 of the Vulnerabilities Equities Policy and Process document. (2) Unclassified information Each report submitted under paragraph (1) shall include an unclassified appendix that contains— (A) the aggregate number of vulnerabilities disclosed to vendors or the public pursuant to the Vulnerabilities Equities Process