; (bb) by striking subclause (III); and (cc) by redesignating subclause (IV) as subclause (III); and (C) in subsection (c)— (i) by redesignating paragraph (2) as paragraph (5); (ii) by striking paragraph (1) and inserting the following: (1) Biennial report Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2023 and not less frequently than once every 2 years thereafter, using the continuous and ongoing agency system risk assessment required under subsection (a)(1)(A), the head of each agency shall submit to the Director, the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, the Comptroller General of the United States, the majority and minority leaders of the Senate, the Speaker and minority leader of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Oversight and Accountability of the House of Representatives, the Committee on Homeland Security of the House of Representatives, the Committee on Commerce, Science, and Transportation of the Senate, the Committee on Science, Space, and Technology of the House of Representatives, and the appropriate authorization and appropriations committees of Congress a report that— (A) summarizes the agency system risk assessment required under subsection (a)(1)(A); (B) evaluates the adequacy and effectiveness of information security policies, procedures, and practices of the agency to address the risks identified in the agency system risk assessment required under subsection (a)(1)(A), including an analysis of the agency’s cybersecurity and incident response capabilities using the metrics established under section 224(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1522(c) )