; (G) engage qualified interested persons, including nongovernmental sector representatives, about the structure of such pilot program as constructive and to the extent practicable; and (H) consult with relevant United States Government officials to ensure that such pilot program complements persistent network and vulnerability scans of the Department of State’s internet-accessible systems, such as the scans conducted pursuant to Binding Operational Directive BOD–15–01. (3) Duration The pilot program established under paragraph (1) should be short-term in duration and not last longer than one year. (b) Report Not later than 180 days after the date on which the bug bounty pilot program under subsection (a) is completed, the Secretary shall submit to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives a report on such pilot program, including information relating to— (1) the number of approved individuals, organizations, or companies involved in such pilot program, broken down by the number of approved individuals, organizations, or companies that— (A) registered; (B) were approved; (C) submitted security vulnerabilities; and (D) received compensation; (2) the number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported as part of such pilot program; (3) the number of previously unidentified security vulnerabilities remediated as a result of such pilot program; (4) the current number of outstanding previously unidentified security vulnerabilities and Department remediation plans; (5) the average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities; (6) the types of compensation provided under such pilot program; and (7) the lessons learned from such pilot program.