; or (D) the contractor or awardee has received personally identifiable information, personal health information, or other clearly sensitive information that is beyond the scope of the contract or agreement with the agency from the agency that the contractor or awardee is not authorized to receive. (2) Third-party reports of vulnerabilities Subject to the guidance issued by the Director pursuant to paragraph (4), any contractor or awardee of an agency shall report to the agency and the Cybersecurity and Infrastructure Security Agency if the contractor or awardee has a reasonable basis to suspect or conclude that a component of any Federal information system operated, managed, or maintained on behalf of an agency by the contractor or awardee on behalf of the agency contains a security vulnerability, including a supply chain compromise or an identified software or hardware vulnerability, that has been reported to the contractor or awardee by a third party, including through a vulnerability disclosure program. (3) Procedures (A) Sharing with CISA As soon as practicable following a report of an incident to an agency by a contractor or awardee under paragraph (1), the head of the agency shall provide, pursuant to section 3594, information about the incident to the Director of the Cybersecurity and Infrastructure Security Agency. (B) Time for reporting Unless a different time for reporting is specified in a contract, grant, cooperative agreement, or other transaction agreement, a contractor or awardee shall— (i) make a report required under paragraph (1) not later than 1 day after the date on which the contractor or awardee has reasonable basis to suspect or conclude that the criteria under paragraph (1) have been met