; and (8) award a contract to an entity, as necessary, to manage the program and implement the remediation of discovered security vulnerabilities. (c) Annual reports Not later than 180 days after the establishment of the VDP under subsection (a) and annually thereafter for the next six years, the Secretary of State shall submit to the Committee on Foreign Affairs of the House of Representatives and the Committee on Foreign Relations of the Senate a report on the following with respect to the VDP: (1) The number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported. (2) The number of previously unidentified security vulnerabilities remediated as a result. (3) The current number of outstanding previously unidentified security vulnerabilities and Department of State remediation plans. (4) The average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities. (5) An estimate of the total cost savings of discovering and addressing security vulnerabilities submitted through the VDP. (6) The resources, surge staffing, roles, and responsibilities within the Department used to implement the VDP and complete security vulnerability remediation. (7) Any other information the Secretary determines relevant. 4. Department of State bug bounty pilot program (a) Establishment of pilot program (1) In general Not later than one year after the date of the enactment of this Act, the Secretary shall establish a bug bounty pilot program to minimize security vulnerabilities of internet-facing information technology of the Department. (2) Requirements In establishing the pilot program described in paragraph (1), the Secretary shall— (A) provide compensation for reports of previously unidentified security vulnerabilities within the websites, applications, and other internet-facing information technology of the Department that are accessible to the public