; (2) develop voluntary, publicly available, practices based on such data, which may be updated as necessary, to guide facility owners and operators in preventing, reducing, and managing security risks; and (3) disseminate such practices to chemical facility owners and operators through an appropriate medium or system, including by making such practices available to the public to the greatest extent practicable. (b) Report (1) Initial report Not later than two years after the date of the enactment of this Act, the Secretary shall submit to Congress a report on the status of implementation plan required under subsection (a), a description of the voluntary, publicly available, practices identified, and the system or medium used to disseminate such practices to chemical facility owners and operators. (2) Annual updates Not later than one year after the submission of the report required under paragraph (1), and annually thereafter, the Secretary shall submit to Congress information on changes to the voluntary practices information disseminated and bases for such changes, information on feedback collected from facility owners and operators regarding the extent to which voluntary practices were adopted, and information on what impact the dissemination of voluntary practices have had on the effectiveness of the program. 9. Study on risks posed by excluded facilities (a) Study required The Secretary of Homeland Security shall enter into an agreement with a non-Department of Homeland Security entity for the conduct of an independent assessment of— (1) the implications for national security and homeland security of exempting from regulation under title XXI of the Homeland Security Act of 2002 ( 6 U.S.C. 621 et seq.) excluded facilities, as such term is defined in section 2101(4) of such Act; (2) the implications for such excluded facilities of exempting such facilities from regulation