; and (ii) the resolution of a security vulnerability described in clause (i); and (B) requirements relating to the scope of vulnerabilities required to be reported under subparagraph (A), such as the minimum severity of a vulnerability required to be reported or whether vulnerabilities that are publicly disclosed are required to be reported. (2) Contractor compliance with coordinated disclosure of security vulnerabilities relating to agency unmanned aircraft systems Subject to the guidance issued under paragraph (1), a contractor or awardee of an agency shall report to the agency and the Director of the Cybersecurity and Infrastructure Security Agency if— (A) a critical component of any unmanned aircraft system operated, managed, or maintained by the contractor or awardee contains a security vulnerability, including a supply chain compromise or an identified software or hardware vulnerability, for which there is reliable evidence of attempted or successful exploitation by an actor without the authorization of the owner of the unmanned aircraft system; or (B) the contractor or awardee has a reasonable basis to suspect or conclude that a critical component of any unmanned aircraft system operated, managed, or maintained on behalf of an agency by the contractor or awardee contains a security vulnerability, including a supply chain compromise or an identified software or hardware vulnerability, that has been reported to the contractor or awardee by a third party, including through a vulnerability disclosure program. (b) Regulations; modifications (1) In general Not later than 1 year after the date of enactment of this Act— (A) the Federal Acquisition Regulatory Council shall promulgate regulations, as appropriate, relating to the responsibilities of contractors and recipients of other transaction agreements and cooperative agreements to comply with subsection (a)(2)