; and (ii) support the cybersecurity improvement efforts of agencies. (B) Format In carrying out subparagraph (A), the Director of the Cybersecurity and Infrastructure Security Agency shall share the analyses— (i) in human-readable written products; and (ii) to the greatest extent practicable, in machine-readable formats in order to enable automated intake and use by agencies. (C) Exemption This subsection shall not apply to incidents that occur exclusively on national security systems. (b) Annual report on Federal incidents Not later than 2 years after the date of enactment of this section, and not less frequently than annually thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, the National Cyber Director and the heads of other agencies, as appropriate, shall submit to the appropriate reporting entities a report that includes— (1) a summary of causes of incidents from across the Federal Government that categorizes those incidents as incidents or major incidents; (2) the quantitative and qualitative analyses of incidents developed under subsection (a)(1) on an agency-by-agency basis and comprehensively across the Federal Government, including— (A) a specific analysis of breaches; and (B) an analysis of the Federal Government’s performance against the metrics established under section 224(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1522(c) ); and (3) an annex for each agency that includes— (A) a description of each major incident; (B) the total number of incidents of the agency