; (4) identify which Department offices and positions will be responsible for receiving, prioritizing, and addressing security vulnerability disclosure reports; (5) consult with the Attorney General regarding how to ensure that individuals, organizations, and companies that comply with the VDP requirements are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law for specific activities authorized under VDP; (6) consult with the relevant offices at the Department of Defense that were responsible for launching the 2016 Vulnerability Disclosure Program, Hack the Pentagon , and subsequent Department of Defense bug bounty programs; (7) engage qualified interested persons, including nongovernmental sector representatives, about the structure of VDP, as constructive and to the extent practicable; and (8) award contracts to entities, as necessary, to manage VDP and implement the remediation of discovered security vulnerabilities. (c) Annual reports Not later than 180 days after the establishment of VDP under subsection (a) and annually thereafter for the following 6 years, the Secretary shall submit a report to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives regarding the establishment of VDP, including information relating to— (1) the number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported through VDP; (2) the number of previously unidentified security vulnerabilities remediated as a result of such reporting; (3) the current number of outstanding previously unidentified security vulnerabilities and the Department's remediation plans to address such vulnerabilities; (4) the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities