; and (B) on or before December 30 each year after the year in which the Legacy Federal IT Inventory is compiled, update such Inventory on the basis of each update to the list provided by an agency Chief Information Officer under paragraph (1)(B). (3) Prioritization List (A) Requirement The Federal Chief Information Officer shall— (i) not later than 90 days after the date on which the Federal Chief Information Officer receives the list required by paragraph (1)(A) from each agency Chief Information Officer, compile, on the basis of each such list, a list of 10 legacy information technology systems that present the greatest security, privacy, and operational risks to the Federal Government; and (ii) not later than 90 days after the date on which the Federal Chief Information Officer receives updates under paragraph (1)(B) from each agency Chief Information Officer, update the list required by subparagraph (A) on the basis of each updates to the list provided by agency Chief information Officers under paragraph (1)(B). (B) Report to Congress Not later than 14 days after the date on which the Federal Chief Information Officer compiles the list required by subparagraph (A), or updates such list, the Director shall submit to the Committee on Oversight and Accountability of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, and the Comptroller General of the United States, a report (which may include a classified annex) containing— (i) such list (including any update made to such list under subparagraph (A)(ii)); and (ii) each list provided by an agency Chief Information Officer under paragraph (1)(A) (including any update made to any such list under paragraph (1)(B)). (4) Guidance (A) In general Not later than 180 days after enactment of this Act, the Director shall issue guidance on implementing the requirements of this subsection that shall, at a minimum— (i) prescribe an appropriate format for list to be provided under paragraph (1)(A)