; or (ii) the Agency identifies or is notified of a cybersecurity incident involving the party or entity, which relates to the vulnerability which led to the issuance of the subpoena; (B) the restriction on the use of information obtained through the subpoena for a cybersecurity purpose, as defined in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ); (C) the retention and destruction of nonpublic information obtained through a subpoena issued under this subsection, including— (i) immediate destruction of information obtained through the subpoena that the Director determines is unrelated to critical infrastructure; and (ii) destruction of any personally identifiable information not later than 6 months after the date on which the Director receives information obtained through the subpoena, unless otherwise agreed to by the individual identified by the subpoena respondent; (D) the processes for providing notice to each party that is subject to the subpoena and each entity at risk identified by information obtained pursuant to a subpoena issued under this subsection; and (E) the processes and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being issued under this subsection. (8) Review of procedures Not later than 1 year after the date of enactment of this subsection, the Privacy Officer of the Agency shall— (A) review the procedures developed by the Director under paragraph (7) to ensure that— (i) the procedures are consistent with fair information practices; and (ii) the operations of the Agency comply with the procedures