; (4) the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities; (5) the resources, surge staffing, roles, and responsibilities within the Department used to implement VDP and complete the necessary security vulnerability remediation; and (6) any other information that the Secretary determines to be relevant. 4. Department of State Bug Bounty Pilot Program (a) Establishment of pilot program (1) In general Not later than 1 year after the date of the enactment of this Act, the Secretary shall establish a Bug Bounty Pilot Program to minimize security vulnerabilities of Internet-facing information technology of the Department. (2) Requirements In establishing the pilot program under paragraph (1), the Secretary shall— (A) provide compensation for reports of previously unidentified security vulnerabilities within the websites, applications, and other Internet-facing information technology of the Department that are accessible to the public; (B) award contracts to entities, as necessary, to manage the pilot program and for executing the remediation of security vul­ner­a­bil­i­ties identified pursuant to subparagraph (A); (C) identify which Department information technology should be included in the pilot program; (D) consult with the Attorney General on how to ensure that individuals, organizations, or companies that comply with the requirements of the pilot program are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law for specific activities authorized under the pilot program; (E) consult with the relevant offices at the Department of Defense that were responsible for launching the 2016 Hack the Pentagon pilot program and subsequent Department of Defense bug bounty programs; (F) develop a process by which an approved individual, organization, or company can— (i) register with entities referred to in subparagraph (B); (ii) submit to a background check, as determined by the Department