; and (B) the Office of Federal Financial Management shall promulgate regulations under title 2, Code of Federal Regulations, as appropriate, relating to the responsibilities of grantees to comply with this section. (2) Implementation Not later than 1 year after the date on which the Federal Acquisition Regulatory Council and the Office of Federal Financial Management promulgates regulations under paragraph (1), the head of each agency shall implement policies and procedures, as appropriate, necessary to implement those regulations. (3) Congressional notification (A) In general The head of each agency head shall notify the Director upon implementation of policies and procedures necessary to implement the regulations promulgated under paragraph (1). (B) OMB notification Not later than 30 days after the date described in paragraph (2), the Director shall notify the Committee on Homeland Security and Governmental Affairs of the Senate and the Committees on Oversight and Accountability and Homeland Security of the House of Representatives on the status of the implementation by each agency of the regulations promulgated under paragraph (1). (c) National security systems exemption Notwithstanding any other provision of this section, a contractor or awardee of an agency that would be required to report an incident or vulnerability pursuant to this section that occurs exclusively on a national security system shall— (1) report the incident or vulnerability to the head of the agency and the Secretary of Defense; and (2) comply with applicable laws and policies relating to national security systems. 3596. Training (a) Covered individual defined In this section, the term covered individual means an individual who obtains access to a Federal information system because of the status of the individual as— (1) an employee, contractor, awardee, volunteer, or intern of an agency