; (B) provide appropriate, detailed technical guidance to prevent a recurrence or the vulnerability or a similar vulnerability in the future; and (C) provide appropriate information regarding any other exploitable vulnerabilities discovered on a system owned or operated by a party or entity during the course of investigation and remediation operations by the Agency. (8) Procedures Not later than 90 days after the date of enactment of this subsection, the Director shall establish internal procedures and associated training, applicable to employees and operations of the Agency, regarding subpoenas issued under this subsection, which shall address— (A) the protection of and restriction on dissemination of nonpublic information obtained through a subpoena issued under this subsection, including a requirement that the Agency shall not disseminate nonpublic information obtained through a subpoena issued under this subsection that identifies the party that is subject to the subpoena or the entity at risk identified by information obtained, unless— (i) the party or entity consents; or (ii) the Agency identifies or is notified of a cybersecurity incident involving the party or entity, which relates to the vulnerability which led to the issuance of the subpoena; (B) the restriction on the use of information obtained through the subpoena for a cybersecurity purpose, as defined in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ); (C) the retention and destruction of nonpublic information obtained through a subpoena issued under this subsection, including— (i) immediate destruction of information obtained through the subpoena that the Director determines is unrelated to critical infrastructure; and (ii) destruction of any personally identifiable information not later than 6 months after the date on which the Director receives information obtained through the subpoena, unless otherwise agreed to by the individual identified by the subpoena respondent