about a vulnerability that is not publicly known. (B) Considerations The process established under subparagraph (A) shall include, with respect to a vulnerability, consideration of the following: (i) Which technologies, products, systems, services, or applications are subject to the vulnerability, including whether the products or systems are used in core Internet infrastructure, in other critical infrastructure systems, in the United States economy, or in national security systems. (ii) The potential risks of leaving the vulnerability unpatched or unmitigated. (iii) The harm that could occur if an actor, such as an adversary of the United States or a criminal organization, were to obtain information about the vulnerability. (iv) How likely it is that the Federal Government would know if someone external to the Federal Government were exploiting the vulnerability. (v) The need of the Federal Government to exploit the vulnerability. (vi) Whether the vulnerability is needed for a specific ongoing intelligence or national security operation. (vii) If a Federal entity would like to exploit the vulnerability to obtain information, whether there are other means available to the Federal entity to obtain such information. (viii) The likelihood that a non-Federal entity will discover the vulnerability. (ix) The risks to foreign countries and the people of foreign countries of not sharing or releasing information about the vulnerability. (x) Whether the vulnerability can be patched or otherwise mitigated. (xi) Whether the affected non-Federal entity has a publicly disclosed policy for reporting and disclosing vulnerabilities. (4) Exclusion from process of vul­ner­a­bil­i­ties presumptively shareable or releasable (A) In general Under guidelines established by the Board, a Federal agency may share or release information to a non-Federal entity about a vulnerability without subjecting such information to the process under paragraph (3)(A) if the agency determines that such information is presumptively shareable or