; or (2) an employee of a contractor or awardee of an agency. (b) Best practices and consistency The Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, the National Cyber Director, and the Director of the National Institute of Standards and Technology, shall develop best practices to support consistency across agencies in cybersecurity incident response training, including— (1) information to be collected and shared with the Cybersecurity and Infrastructure Security Agency pursuant to section 3594(a) and processes for sharing such information; and (2) appropriate training and qualifications for cyber incident responders. (c) Agency training The head of each agency shall develop training for covered individuals on how to identify and respond to an incident, including— (1) the internal process of the agency for reporting an incident; and (2) the obligation of a covered individual to report to the agency any suspected or confirmed incident involving Federal information in any medium or form, including paper, oral, and electronic. (d) Inclusion in annual training The training developed under subsection (c) may be included as part of an annual privacy, security awareness, or other appropriate training of an agency. 3597. Analysis and report on Federal incidents (a) Analysis of Federal incidents (1) Quantitative and qualitative analyses The Director of the Cybersecurity and Infrastructure Security Agency shall perform and, in coordination with the Director and the National Cyber Director, develop, continuous monitoring and quantitative and qualitative analyses of incidents at agencies, including major incidents, including— (A) the causes of incidents, including— (i) attacker tactics, techniques, and procedures; and (ii) system vulnerabilities, including zero days, unpatched systems, and information system misconfigurations; (B) the scope and scale of incidents at agencies; (C) common root causes of incidents across multiple agencies