; and (ii) the aggregate number of vulnerabilities disclosed to each responsible vendor, delineated by the amount of time required to patch or mitigate the vulnerability, as defined by thirty day increments. (3) Form Each report submitted under paragraph (1) shall be in classified form. (c) Vulnerabilities equities policy and process of the Federal Government defined In this section, the term vulnerabilities equities policy and process of the Federal Government means the policy and process established by the National Security Council for the Federal Government, or successor set of policies and processes, establishing policy and responsibilities for disseminating information about vulnerabilities discovered by the Federal Government or its contractors, or disclosed to the Federal Government by the private sector in government off-the-shelf (GOTS), commercial off-the-shelf (COTS), or other commercial information technology or industrial control products or systems (including both hardware and software). 605. Bug bounty programs (a) Definitions In this section: (1) Bug bounty program The term bug bounty program means a program under which an approved computer security specialist or security researcher is temporarily authorized to identify and report vulnerabilities within an information system in exchange for payment. (2) Information system The term information system has the meaning given that term in section 3502 of title 44, United States Code. (b) Bug bounty program plan (1) Requirement Not later than 180 days after the date of the enactment of this Act, the Under Secretary for Intelligence and Analysis of the Department of Homeland Security shall submit to the congressional intelligence committees a strategic plan to implement bug bounty programs at appropriate agencies and departments of the United States. (2) Contents The plan required by paragraph (1) shall include— (A) an assessment of— (i) the effectiveness of the Hack the Pentagon pilot program carried out by the Department of Defense in 2016 and