; (3) in section 3554— (A) in subsection (a)— (i) in paragraph (1)— (I) by redesignating subparagraphs (A), (B), and (C) as subparagraphs (B), (C), and (D), respectively; (II) by inserting before subparagraph (B), as so redesignated, the following: (A) on an ongoing and continuous basis, assessing agency system risk, as applicable, by— (i) identifying and documenting the high value assets of the agency using guidance from the Director; (ii) evaluating the data assets inventoried under section 3511 for sensitivity to compromises in confidentiality, integrity, and availability; (iii) identifying whether the agency is participating in federally offered cybersecurity shared services programs; (iv) identifying agency systems that have access to or hold the data assets inventoried under section 3511; (v) evaluating the threats facing agency systems and data, including high value assets, based on Federal and non-Federal cyber threat intelligence products, where available; (vi) evaluating the vulnerability of agency systems and data, including high value assets, including by analyzing— (I) the results of penetration testing performed by the Department of Homeland Security under section 3553(b)(9); (II) the results of penetration testing performed under section 3559A; (III) information provided to the agency through the vulnerability disclosure program of the agency under section 3559B; (IV) incidents; and (V) any other vulnerability information relating to agency systems that is known to the agency; (vii) assessing the impacts of potential agency incidents to agency systems, data, and operations based on the evaluations described in clauses (ii) and (v) and the agency systems identified under clause (iv); and (viii) assessing the consequences of potential incidents occurring on agency systems that would impact systems at other agencies, including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system;