; and (2) consistent with relevant policies, appropriate Federal law enforcement agencies to facilitate threat response activities. 3595. Responsibilities of contractors and awardees (a) Reporting (1) In general Any contractor or awardee of an agency shall report to the agency if the contractor or awardee has a reasonable basis to conclude that— (A) an incident or breach has occurred with respect to Federal information the contractor or awardee collected, used, or maintained on behalf of an agency; (B) an incident or breach has occurred with respect to a Federal information system used, operated, managed, or maintained on behalf of an agency by the contractor or awardee; (C) a component of any Federal information system operated, managed, or maintained by a contractor or awardee contains a security vulnerability, including a supply chain compromise or an identified software or hardware vulnerability, for which there is reliable evidence of attempted or successful exploitation of the vulnerability by an actor without authorization of the Federal information system owner