; and (III) by striking preceding year and inserting preceding 2 years ; (ii) by striking paragraph (1); (iii) by redesignating paragraphs (2), (3), and (4) as paragraphs (1), (2), and (3), respectively; (iv) in paragraph (3), as so redesignated, by striking and at the end; and (v) by inserting after paragraph (3), as so redesignated, the following: (4) a summary of the risks and trends identified in the Federal risk assessment required under subsection (i); and ; (D) in subsection (h)— (i) in paragraph (2)— (I) in subparagraph (A), by inserting and the National Cyber Director after in coordination with the Director ; and (II) in subparagraph (D), by inserting , the National Cyber Director, after notify the Director ; and (ii) in paragraph (3)(A)(iv), by inserting , the National Cyber Director, after the Secretary provides prior notice to the Director ; (E) by amending subsection (i) to read as follows: (i) Federal risk assessment On an ongoing and continuous basis, the Director of the Cybersecurity and Infrastructure Security Agency shall assess the Federal risk posture using any available information on the cybersecurity posture of agencies, and brief the Director and National Cyber Director on the findings of such assessment, including— (1) the status of agency cybersecurity remedial actions for high value assets described in section 3554(b)(7); (2) any vulnerability information relating to the systems of an agency that is known by the agency; (3) analysis of incident information under section 3597; (4) evaluation of penetration testing performed under section 3559A; (5) evaluation of vulnerability disclosure program information under section 3559B; (6) evaluation of agency threat hunting results; (7) evaluation of Federal and non-Federal cyber threat intelligence; (8) data on agency compliance with standards issued under section 11331 of title 40; (9) agency system risk assessments required under section 3554(a)(1)(A)