; and (3) an annex for each agency that includes— (A) a description of each major incident; (B) the total number of incidents of the agency; and (C) an analysis of the agency’s performance against the metrics established under section 224(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1522(c) ). (c) Publication (1) In general The Director of the Cybersecurity and Infrastructure Security Agency shall make a version of each report submitted under subsection (b) publicly available on the website of the Cybersecurity and Infrastructure Security Agency during the year during which the report is submitted. (2) Exemption The publication requirement under paragraph (1) shall not apply to a portion of a report that contains content that should be protected in the interest of national security, as determined by the Director, the Director of the Cybersecurity and Infrastructure Security Agency, or the National Cyber Director. (3) Limitation on exemption The exemption under paragraph (2) shall not apply to any version of a report submitted to the appropriate reporting entities under subsection (b). (4) Requirement for compiling information (A) Compilation Subject to subparagraph (B), in making a report publicly available under paragraph (1), the Director of the Cybersecurity and Infrastructure Security Agency shall sufficiently compile information so that no specific incident of an agency can be identified. (B) Exception The Director of the Cybersecurity and Infrastructure Security Agency may include information that enables a specific incident of an agency to be identified in a publicly available report— (i) with the concurrence of the Director and the National Cyber Director; (ii) in consultation with the impacted agency