; and (C) describes the process by which a review is conducted, including how long it will take for the contractor to respond to researcher and whether or not monetary rewards will be paid to the reporter for identifying a vulnerability. (5) In the case of a discovered vulnerability that the contractor is not responsible for patching, the contractor shall submit the vulnerability to the responsible party or direct the researcher to the appropriate party. (b) Reporting requirements and metrics Not later than 7 days after the date on which the vulnerability disclosure policy described in subsection (a) is published, and on an ongoing basis as vulnerability reports are received, an information technology contractor shall report to the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security the following information: (1) Any valid or credible report of a not previously known public vulnerability (including any misconfiguration) on a system that uses commercial software or services that affect or are likely to affect other parties in government or industry once a patch or viable mitigation is available. (2) Any other situation where the contractor determines it would be helpful or necessary to involve the Cybersecurity and Infrastructure Security Agency. (c) CISA submission of vulnerabilities The Cybersecurity and Infrastructure Security Agency shall communicate with and submit, as necessary, vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database. (d) Definitions In this section: (1) Executive agency The term executive agency has the meaning given that term in section 133. (2) Researcher The term researcher means the individual who submits a vulnerability report. (3) Information technology The term information technology has the meaning given that term in section 11101 of title 40. . (b) Technical and conforming amendment The table of sections for chapter 47 of division C of