; and (ii) a date by which measures to so mitigate such vulnerability shall be implemented by the Transportation Security Administration. (4) Retesting Not later than 180 days after the date on which measures to mitigate a vulnerability are completed by the Transportation Security Administration pursuant to paragraph (3)(B)(ii), the Administrator shall conduct a covert test in accordance with subsection (a) of the aviation security operation with respect to which such vulnerability was identified to assess the effectiveness of such measures to mitigate such vulnerability. (c) Compilation of lists (1) In general Not later than 60 days after completing a covert testing protocol under subsection (a), the Administrator of the Transportation Security Administration shall compile a list (including a classified annex if necessary) of the vulnerabilities identified and assessed pursuant to such testing. Each such list shall contain, at a minimum, the following: (A) A brief description of the nature of each vulnerability so identified and assessed. (B) The date on which each vulnerability was so identified and assessed. (C) Key milestones appropriate for the level of effort required to mitigate each vulnerability, as well as an indication of whether each such milestone has been met. (D) An indication of whether each vulnerability has been mitigated or reduced and, if so, the date on which each such vulnerability was so mitigated or reduced. (E) If a vulnerability has not been fully mitigated, the date by which the Administrator shall so mitigate such vulnerability or a determination that it is not possible to fully mitigate such vulnerability. (F) The results of any subsequent covert testing undertaken to assess whether mitigation efforts have eliminated or reduced each vulnerability. (2) Submission to Congress The Administrator shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a comprehensive document tracking the