; (ii) if the incident involves goods or services provided to an election agency, the vendor submits a notification meeting the requirements of subparagraph (B) to the agency as soon as practicable (but in no case later than 3 days after the vendor first becomes aware of the possibility that the incident occurred), and cooperates with the agency in providing any other necessary notifications relating to the incident; and (iii) the vendor provides all necessary updates to any notification submitted under clause (i) or clause (ii). (B) Contents of notifications Each notification submitted under clause (i) or clause (ii) of subparagraph (A) shall contain the following information with respect to any election cybersecurity incident covered by the notification: (i) The date, time, and time zone when the election cybersecurity incident began, if known. (ii) The date, time, and time zone when the election cybersecurity incident was detected. (iii) The date, time, and duration of the election cybersecurity incident. (iv) The circumstances of the election cybersecurity incident, including the specific election infrastructure systems believed to have been accessed and information acquired, if any. (v) Any planned and implemented technical measures to respond to and recover from the incident. (vi) In the case of any notification which is an update to a prior notification, any additional material information relating to the incident, including technical data, as it becomes available. 297B. Eligibility of States A State is eligible to receive a grant under this part if the State submits to the Commission, at such time and in such form as the Commission may require, an application containing— (1) a description of how the State will use the grant to carry out the activities authorized under this part; (2) a certification and assurance that, not later than 5 years after receiving the grant, the State will carry out risk-limiting audits and will carry out voting system security improvements, as described in section 297A