; and (III) a clear statement— (aa) that any individual that submits a vulnerability report may do so anonymously; and (bb) on how and whether any incomplete submission is evaluated; (v) a commitment from the contractor that the contractor will not pursue civil action for any accidental, good faith violation of the vulnerability disclosure policy; (vi) a commitment from the contractor that if an individual acting in accordance with the vulnerability disclosure policy of the contractor is sued by a third party, the contractor will inform the public or the court that the individual was acting in compliance with the vulnerability disclosure policy; (vii) a statement that describes the time frame in which the individual that submits a report, if known, will receive a notification of receipt of the report and a description of what steps will be taken by the contractor during the remediation process; and (viii) a set of guidelines that establishes what type of activity by a researcher are acceptable and unacceptable; and (B) does not— (i) require the submission of personally identifiable information of a researcher; and (ii) limit testing solely to entities approved by the contractor but rather authorizes the public to search for and report any vulnerability. (2) A description of additional procedures that describe how the contractor will communicate with the researcher, and how and when any communication occurs. (3) A description of the target timelines for and tracking of the following: (A) Notification of receipt to the individual that submits the report, if known. (B) An initial assessment, such as determining whether any disclosed vulnerability is valid. (C) Resolution of a vulnerability, including notification of the outcome to the researcher. (4) A page on the website of the contractor that— (A) allows for the submission of vulnerabilities by anyone relating to the information technology