; (ii) the Federal Government; (iii) the national security, foreign relations, homeland security, and economic security of the United States; and (iv) the civil liberties, public confidence, privacy, and public health and safety of the people of the United States. (D) If applicable, whether any ransom has been demanded or paid, or is expected to be paid, by any entity operating a Federal information system or with access to Federal information or a Federal information system, including, as available, the name of the entity demanding ransom, the date of the demand, and the amount and type of currency demanded, unless disclosure of such information will disrupt an active Federal law enforcement or national security operation. (c) Supplemental update Within a reasonable amount of time, but not later than 30 days after the date on which the head of an agency submits a written notification under subsection (a), the head of the agency shall provide to the appropriate congressional entities an unclassified and written update, which may include 1 or more annexes that contain classified or other sensitive information, as appropriate, on the major incident, based on information available to agency officials as of the date on which the agency provides the update, on— (1) system vulnerabilities relating to the major incident, where applicable, means by which the major incident occurred, the threat causing the major incident, where applicable, and impacts of the major incident to— (A) the agency; (B) other Federal agencies, Congress, or the judicial branch; (C) the national security, foreign relations, homeland security, or economic security of the United States; or (D) the civil liberties, public confidence, privacy, or public health and safety of the people of the United States; (2) the status of compliance of the affected Federal information system with applicable security requirements at the time of the major incident