; and (B) includes a crypto asset intermediary, as defined in section 9801 of title 31, United States Code. . (2) Required reporting If a crypto asset intermediary makes a required report under section 2242 of the Homeland Security Act of 2002 ( 6 U.S.C. 681b ), the crypto asset intermediary shall make a copy of that report available to the Federal or State financial regulator responsible for licensing or supervising the crypto asset intermediary. (b) Requirement Not later than 18 months after the date of enactment of this Act, the Commodity Futures Trading Commission and the Securities and Exchange Commission, in consultation with the Secretary of the Treasury and the Director of the Cybersecurity and Infrastructure Security Agency, shall develop comprehensive, principles-based guidance relating to cybersecurity for crypto asset intermediaries that account for, with respect to such a crypto asset intermediary— (1) the internal governance, and organizational culture, of the cybersecurity program of the crypto asset intermediary; (2) security operations of the crypto asset intermediary, including threat identification, incident response, and mitigation; (3) risk identification and measurement by the crypto asset intermediary; (4) the mitigation of risk by the crypto asset intermediary, including policies of the crypto asset intermediary, controls implemented by the crypto asset intermediary, change management with respect to the crypto asset intermediary, and the supply chain integrity of the crypto asset intermediary; (5) assurance provided by, and testing conducted by, the crypto asset intermediary, including penetration testing and independent audits so conducted