; (3) upon a request by an agency, assist the agency in the disclosure to vendors of newly identified security vulnerabilities in vendor products and services; and (4) as appropriate, implement the requirements of this section, in accordance with the authority under section 3553(b)(8), as a shared service available to agencies. (f) Responsibilities of agencies (1) Public information The head of each agency shall make publicly available, with respect to each internet domain under the control of the agency that is not a national security system and to the extent consistent with the security of information systems but with the presumption of disclosure— (A) an appropriate security contact; and (B) the component of the agency that is responsible for the internet accessible services offered at the domain. (2) Vulnerability disclosure policy The head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency, which shall— (A) describe— (i) the scope of the systems of the agency included in the vulnerability disclosure policy, including for internet of things devices owned or controlled by the agency; (ii) the type of information system testing that is authorized by the agency; (iii) the type of information system testing that is not authorized by the agency; (iv) the disclosure policy for a contractor; and (v) the disclosure policy of the agency for sensitive information; (B) with respect to a vulnerability disclosure report to an agency, describe— (i) how the submitter should submit the vulnerability disclosure report; and (ii) if the report is not anonymous, when the reporter should anticipate an acknowledgment of receipt of the report by the agency; (C) include any other relevant information