; (B) users conducting authorized operations or movements of Department of Defense materiel; or (C) specific civilian employees of the Department or contractors whom the Secretary determines likely to be a target of a foreign actor. (c) Guidance and updates The Secretary of Defense shall— (1) issue guidance to all Department personnel incorporating the categories of foreign mobile applications of concern and advising how to mitigate the risks identified by the risk framework with respect to such applications; (2) routinely update the categorical definitions and risk framework promulgated pursuant to subsection (a), at least on an annual basis; and (3) prescribe, if feasible, regulations that appropriately mitigate risks from applications on devices provided by the Department of Defense or on any device used during an activity described in subsection (b)(3)(B) or at locations described under (b)(3)(A).