and services, proposed timelines for delivery, and whether to continue the use of phased rollout plans, related to securing networks, devices, data, and information and operational technology assets through the use of such program. (3) Form The strategy required under paragraph (1) shall be submitted in an unclassified form, but may contain a classified annex. (c) Report Not later than 180 days after the development of the strategy required under subsection (b), the Secretary of Homeland Security shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representative a report on cybersecurity risk posture based on the data collected through the continuous diagnostics and mitigation program under subsection (g) of section 2213 of the Homeland Security Act of 2002 ( 6 U.S.C. 663 ), as added by subsection (a). (d) GAO report Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall submit a report to Congress on the potential impacts and benefits of replacing the reporting requirements under chapter 35 of title 44, United States Code, with periodical real-time data provided by the continuous diagnostics and mitigation program under subsection (g) of section 2213 of the Homeland Security Act of 2002 ( 6 U.S.C. 663 ), as added by subsection (a).