; and (C) vulnerabilities disclosed since the previous report that have either— (i) been patched or mitigated by the responsible vendor; or (ii) have not been patched or mitigated by the responsible vendor and more than 180 days have elapsed since the vulnerability was disclosed. (2) Contents Each report submitted under paragraph (1) shall include the following: (A) The date the vulnerability was disclosed to the responsible vendor. (B) The date the patch or mitigation for the vulnerability was made publicly available by the responsible vendor. (C) An unclassified appendix that includes— (i) a top-line summary of the aggregate number of vulnerabilities disclosed to vendors, how many have been patched, and the average time between disclosure of the vulnerability and the patching of the vulnerability