; (B) align policy and system requirements to enable the Department to have enterprise-wide visibility of cyber incident reporting to support rapid and appropriate response; and (C) distribute new guidance to Department personnel on cyber incident reporting, which shall include detailed procedures for identifying, reporting, and notifying Department leadership of critical cyber incidents. (2) Defense industrial base Not later than 180 days after the date of the enactment of this Act, the Secretary shall ensure that the Chief Information Officer determines what actions need to be taken to encourage more complete and timely mandatory cyber incident reporting from persons in the defense industrial base. (3) Data breach notification The Secretary shall ensure that components of the Department document instances in which Department personnel affected by a privacy data breach are notified of the breach within 72 hours of the discovery of the breach. (b) Assessment on establishing office of cyber statistics (1) In general Not later than one year after the date of the enactment of this Act, the Secretary of Defense shall complete an assessment of the feasibility and suitability of establishing, and resourcing required to establish, an office of cyber statistics to track cyber incidents and measure the response time of defense agencies and the military departments to address cyber threats, risks, and vulnerabilities. (2) Elements The assessment required under paragraph (1) shall include an evaluation of the feasibility, suitability, and resourcing required for defense agencies and the military departments— (A) to collect data on the amount of time it takes to detect a cyber incident; (B) to respond to a cyber incident; (C) to fully mitigate the risk of high-impact cyber vulnerabilities; (D) to recover data following a malicious cyber intrusion