; (2) an identification of existing authorities for addressing such risks; (3) an identification and promulgation of best practices and procedures and available resources for executive agencies to assess and mitigate such risks; (4) recommendations for any legislative, regulatory, or other policy changes to improve efforts to address such risks; (5) an evaluation of the effect of implementing new policies or procedures on existing contracts and the procurement process; (6) a plan for engaging with executive agencies, the private sector, and other nongovernmental stakeholders to address such risks; and (7) plans to strengthen the capacity of all executive agencies to conduct assessments of— (A) the supply chain risk posed by the acquisition of information technology; and (B) compliance with the requirements of this subchapter. (b) Submission to Congress Not later than 7 days after completion of the strategic plan required by subsection (a), the Chairperson of the Council shall submit the plan to the appropriate congressional committees. 1325. Annual report Not later than December 31 of each year, the Chairperson of the Council shall submit to the appropriate congressional committees a report on the activities of the Council during the preceding 12-month period. 1326. Requirements for executive agencies (a) In general The head of each executive agency shall— (1) be responsible for conducting assessments of the supply chain risks posed by the acquisition of information technology by that agency, developing mitigation and response requirements, and ensuring ongoing management of such risks; (2) share relevant information with other executive agencies as determined appropriate by the Administrator in a manner consistent with section 1323