; (D) the processes for providing notice to each party that is subject to the subpoena and each entity at risk identified by information obtained pursuant to a subpoena issued under this subsection; (E) the processes and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being issued under this subsection; and (F) the processes for assisting a party or entity with removal, remediation, or other corrective measures required to address the vulnerability identified by the subpoena and, upon request, providing other resources to parties or entities to prevent a recurrence of the vulnerability or a related vulnerability in the future. (9) Review of procedures Not later than 1 year after the date of enactment of this subsection, the Privacy Officer of the Agency shall— (A) review the procedures developed by the Director under paragraph (8) to ensure that— (i) the procedures are consistent with fair information practices; and (ii) the operations of the Agency comply with the procedures; and (B) notify the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives of the results of the review. (10) Publication of information Not later than 120 days after establishing the internal procedures under paragraph (8), the Director shall make publicly available information regarding the subpoena process under this subsection, including regarding— (A) the purpose for subpoenas issued under this subsection; (B) the subpoena process; (C) the criteria for the critical infrastructure security risk assessment conducted prior to issuing a subpoena; (D) policies and procedures on retention and sharing of data obtained by subpoena; (E) guidelines on how entities contacted by the Director may respond to notice of a subpoena