; (D) consider requiring recipients of covered support to implement additional research security mitigations for higher-risk activities if appropriate; and (E) support the development of research security training for recipients of covered support on the risks posed by entities of concern. (3) Annual updates The tools and processes developed under paragraph (1) shall be evaluated annually and updated as needed, with threat-informed input from the Office of Intelligence and Counterintelligence, to reflect changes in the risk designation under paragraph (2)(A) of research, development, demonstration, and deployment activities conducted by the Department of Energy. (c) Entity of concern (1) Prohibition Except as provided in paragraph (2), no entity of concern, or individual that owns or controls, is owned or controlled by, or is under common ownership or control with an entity of concern, may receive, or perform work under, any covered support. (2) Waiver of prohibition (A) In general The Secretary may waive the prohibition under paragraph (1) if determined by the Secretary to be in the national interest. (B) Notification to Congress Not less than 2 weeks prior to issuing a waiver under subparagraph (A), the Secretary shall notify Congress of the intent to issue the waiver, including a justification for the waiver. (3) Penalty (A) Termination of support On finding that any entity of concern or individual described in paragraph (1) has received covered support and has not received a waiver under paragraph (2), the Secretary shall terminate all covered support to that entity of concern or individual, as applicable. (B) Penalties An entity of concern or individual identified under subparagraph (A) shall be— (i) prohibited from receiving or participating in covered support for a period of not less than 1 year but not more than 10 years, as determined by the Secretary