; (iii) in paragraph (5)(A), by inserting , including penetration testing, as appropriate, after shall include testing ; (iv) by redesignating paragraphs (7) and (8) as paragraphs (8) and (9), respectively; (v) by inserting after paragraph (6) the following: (7) a secure process for providing the status of every remedial action and unremediated identified system vulnerability of a high value asset to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable; ; and (vi) in paragraph (8)(C), as so redesignated— (I) by striking clause (ii) and inserting the following: (ii) notifying and consulting with the Federal information security incident center established under section 3556 pursuant to the requirements of section 3594; ; (II) by redesignating clause (iii) as clause (iv); (III) by inserting after clause (ii) the following: (iii) performing the notifications and other activities required under subchapter IV of this chapter; and ; and (IV) in clause (iv), as so redesignated— (aa) in subclause (II), by adding and at the end; (bb) by striking subclause (III); and (cc) by redesignating subclause (IV) as subclause (III); and (C) in subsection (c)— (i) by redesignating paragraph (2) as paragraph (5)