; (C) any incident the head of the agency determines substantially disrupts or substantially degrades the operations of a high value asset owned or operated by the agency; (D) any incident involving the exposure to a foreign entity of sensitive agency information, such as the communications of the head of the agency, the head of a component of the agency, or the direct reports of the head of the agency or the head of a component of the agency; and (E) any other type of incident determined appropriate by the Director; (2) stipulate that the National Cyber Director, in consultation with the Director and the Director of the Cybersecurity and Infrastructure Security Agency, may declare a major incident at any agency, and such a declaration shall be considered if it is determined that an incident— (A) occurs at not less than 2 agencies; and (B) is enabled by— (i) a common technical root cause, such as a supply chain compromise, or a common software or hardware vulnerability; or (ii) the related activities of a common threat actor; (3) stipulate that, in determining whether an incident constitutes a major incident under the standards described in paragraph (1), the head of the agency shall consult with the National Cyber Director; and (4) stipulate that the mere report of a vulnerability discovered or disclosed without a loss of confidentiality, integrity, or availability shall not on its own constitute a major incident. (c) Evaluation and updates Not later than 60 days after the date on which the Director first promulgates the guidance required under subsection (a), and not less frequently than once during the first 90 days of each evenly numbered Congress thereafter, the Director shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committees on Oversight and Accountability and Homeland Security of the House of Representatives a briefing that includes— (1) an evaluation of any necessary updates to the guidance