; and (B) provide associated training applicable to employees and operations of the Agency to comply with internal procedures established pursuant to paragraph (8). (11) Publication of information Not later than 120 days after establishing the internal procedures and policies under paragraph (8), the Director shall make publicly available, including on a Department website, information regarding the subpoena process under this subsection, including regarding the following: (A) The purpose for subpoenas issued under this subsection. (B) The subpoena process. (C) The criteria for the critical infrastructure security risk assessment conducted prior to issuing a subpoena. (D) Policies and procedures on retention and sharing of data obtained by a subpoena. (E) The process for providing notice to each entity at risk identified by information obtained pursuant to a subpoena issued under this subsection, and contact information that such an entity may use to confirm the authenticity of such notice. (F) Guidelines on how entities at risk contacted by the Director may respond to notice of a subpoena. (G) The internal procedures of the Agency established pursuant to paragraph (8). (12) Annual reports Not later than six months after the establishment of the internal procedures and associated training pursuant to paragraph (8) and annually thereafter, the Director shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report (which may include a classified annex but with the presumption of declassification) on the use of subpoenas under this subsection by the Director, which shall include the following: (A) A discussion of the following: (i) The effectiveness of the use of subpoenas to mitigate security vulnerabilities. (ii) The critical infrastructure security risk assessment process conducted for subpoenas issued under this subsection. (iii) The number of subpoenas issued under this subsection by the Director during