; and (ii) make a report required under paragraph (2) within a reasonable time, but not later than 90 days after the date on which the contractor or awardee has reasonable basis to suspect or conclude that the criteria under paragraph (2) have been met. (C) Procedures Following a report of a breach or incident to an agency by a contractor or awardee under paragraph (1), the head of the agency, in consultation with the contractor or awardee, shall carry out the applicable requirements under sections 3592, 3593, and 3594 with respect to the breach or incident. (D) Rule of construction Nothing in subparagraph (B) shall be construed to allow the negation of the requirements to report vulnerabilities under paragraph (1) or (2) through a contract, grant, cooperative agreement, or other transaction agreement. (4) Guidance The Director shall issue guidance to agencies relating to the scope of vulnerabilities to be reported under paragraph (2), such as the minimum severity of a vulnerability required to be reported or whether vulnerabilities that are already publicly disclosed must be reported. (b) Regulations; modifications (1) In general Not later than 1 year after the date of enactment of the Federal Information Security Modernization Act of 2023 — (A) the Federal Acquisition Regulatory Council shall promulgate regulations, as appropriate, relating to the responsibilities of contractors and recipients of other transaction agreements and cooperative agreements to comply with this section