; or (II) the Agency identifies or is notified of a cybersecurity incident involving the party or entity, which relates to the security vulnerability which led to the issuance of such a subpoena. (ii) The restriction on the use of information obtained through the subpoena for a cybersecurity purpose. (iii) The retention and destruction of nonpublic information obtained through such a subpoena, including the following: (I) Immediate destruction of information obtained through such a subpoena that the Director determines is unrelated to critical infrastructure. (II) Destruction of any personally identifiable information not later than six months after the date on which the Director receives information obtained through such a subpoena, unless otherwise agreed to by the individual so identified. (iv) The process for recordkeeping regarding efforts referred to in paragraph (1) undertaken prior to the issuance of such a subpoena. (v) The process for tracking engagement with each party that is subject to such a subpoena and the entity at risk identified by information obtained pursuant to such a subpoena. (vi) The process for providing notice to each party that is subject to such a subpoena and each entity at risk identified by information obtained pursuant to such a subpoena. (vii) The process and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being so issued. (B) Congressional notification The Director shall brief the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate upon establishment of internal procedures and associated training required under this subsection. (9) Review of procedures Not later than one year after the date of enactment of this subsection, the Privacy Officer of the Agency, in consultation with the Privacy Officer of the Department, shall— (A) review the internal procedures and associated training established by the Director