; or (2) purchase a Standard Terminal Automation Replacement System or any equivalent system and installation and maintenance services directly from an OEM. 407. Audit of legacy systems (a) In general Not later than 120 days after the date of enactment of this section, the Administrator shall initiate an audit of all legacy systems to determine their level of operational risk, functionality, security, and compatibility with current and future technology. (b) Scope of audit The audit required by subsection (a)— (1) shall be conducted by an independent third-party contractor or a Federally funded research and development center (FFRDC) selected by the Administrator; (2) shall include an assessment of whether a legacy system is outdated, insufficient, unsafe, or unstable, as defined in subsection (f); and (3) with respect to any legacy systems identified in the audit as outdated, insufficient, unsafe, or unstable, shall include— (A) an analysis of the operational risks associated with using such legacy systems; (B) recommendations for replacement or enhancement of such legacy systems; and (C) an analysis of any potential impact on aviation safety and efficiency. (c) Deadline Not later than December 31, 2025, the audit required by subsection (a) shall be completed. (d) Report Not later than 180 days after the audit required by subsection (a) is completed, the Administrator shall provide a report to the appropriate committees of Congress on the audit's findings and recommendations, including— (1) an inventory of the legacy systems in use; (2) an assessment of the operational condition of the legacy systems in use