; (D) policies and procedures on retention and sharing of data obtained by subpoena; (E) guidelines on how entities contacted by the Director may respond to notice of a subpoena; and (F) the procedures and policies of the Agency developed under paragraph (8). (11) Annual reports The Director shall annually submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report (which may include a classified annex but with the presumption of declassification) on the use of subpoenas under this subsection by the Director, which shall include— (A) a discussion of— (i) the effectiveness of the use of subpoenas to mitigate critical infrastructure security vulnerabilities; (ii) the critical infrastructure security risk assessment process conducted for subpoenas issued under this subsection; (iii) the number of subpoenas issued under this subsection by the Director during the preceding year; (iv) to the extent practicable, the number of vulnerable enterprise devices or systems mitigated under this subsection by the Agency during the preceding year; and (v) the number of entities notified by the Director under this subsection, and their response, during the previous year; and (B) for each subpoena issued under this subsection— (i) the source of the security vulnerability detected, identified, or received by the Director; (ii) the steps taken to identify the entity at risk prior to issuing the subpoena