; ; (III) in subparagraph (B), as so redesignated, in the matter preceding clause (i), by striking providing information and inserting using information from the assessment required under subparagraph (A), providing information ; (IV) in subparagraph (C), as so redesignated— (aa) in clause (ii) by inserting binding before operational ; and (bb) in clause (vi), by striking and at the end; and (V) by adding at the end the following: (E) providing an update on the ongoing and continuous assessment required under subparagraph (A)— (i) upon request, to the inspector general of the agency or the Comptroller General of the United States; and (ii) at intervals determined by guidance issued by the Director, and to the extent appropriate and practicable using automation, to— (I) the Director; (II) the Director of the Cybersecurity and Infrastructure Security Agency; and (III) the National Cyber Director; ; (ii) in paragraph (2)— (I) in subparagraph (A), by inserting in accordance with the agency system risk assessment required under paragraph (1)(A) after information systems ; (II) in subparagraph (D), by inserting , through the use of penetration testing, the vulnerability disclosure program established under section 3559B, and other means, after periodically ; (iii) in paragraph (3)(A)— (I) in the matter preceding clause (i), by striking senior agency information security officer and inserting Chief Information Security Officer ; (II) in clause (i), by striking this section and inserting subsections (a) through (c) ; (III) in clause (ii), by striking training and and inserting skills, training, and ; (IV) by redesignating clauses (iii) and (iv) as (iv) and (v), respectively; (V) by inserting after clause (ii) the following: (iii) manage information security, cybersecurity budgets, and risk and compliance activities and explain those concepts to the head of the agency and the executive team of the agency;