; and (C) summarizes the status of remedial actions identified by inspector general of the agency, the Comptroller General of the United States, and any other source determined appropriate by the head of the agency. (2) Unclassified reports Each report submitted under paragraph (1)— (A) shall be, to the greatest extent practicable, in an unclassified and otherwise uncontrolled form; and (B) may include 1 or more annexes that contain classified or other sensitive information, as appropriate. (3) Briefings During each year during which a report is not required to be submitted under paragraph (1), the Director shall provide to the congressional committees described in paragraph (1) a briefing summarizing current agency and Federal risk postures. ; and (iii) in paragraph (5), as so redesignated, by striking the period at the end and inserting , including the reporting procedures established under section 11315(d) of title 40 and subsection (a)(3)(A)(v) of this section ; (4) in section 3555— (A) in the section heading, by striking Annual independent and inserting Independent ; (B) in subsection (a)— (i) in paragraph (1), by inserting during which a report is required to be submitted under section 3553(c), after Each year ; (ii) in paragraph (2)(A), by inserting , including by performing, or reviewing the results of, agency penetration testing and analyzing the vulnerability disclosure program of the agency after information systems ; and (iii) by adding at the end the following: (3) An evaluation under this section may include recommendations for improving the cybersecurity posture of the agency. ; (C) in subsection (b)(1), by striking annual ; (D) in subsection (e)(1), by inserting during which a report is required to be submitted under section 3553(c) after Each year ; (E) in subsection (g)(2)— (i) by striking this subsection shall and inserting “this subsection— (A) shall ; (ii) in subparagraph (A), as so designated, by striking the period at the end and inserting ; and