; (2) direction to not recommend or pursue legal action against a submitter or an individual that conducts a security research activity that— (A) represents a good faith effort to identify and report security vulnerabilities in information systems; or (B) otherwise represents a good faith effort to follow the vulnerability disclosure policy of the agency developed under subsection (f)(2); (3) direction on sharing relevant information in a consistent, automated, and machine readable manner with the Director of the Cybersecurity and Infrastructure Security Agency; (4) the minimum scope of agency systems required to be covered by the vulnerability disclosure policy of an agency required under subsection (f)(2), including exemptions under subsection (g); (5) requirements for providing information to the submitter of a vulnerability disclosure report on the resolution of the vulnerability disclosure report; (6) a stipulation that the mere identification by a submitter of a security vulnerability, without a significant compromise of confidentiality, integrity, or availability, does not constitute a major incident; and (7) the applicability of the guidance to Internet of things devices owned or controlled by an agency. (d) Consultation In developing the guidance required under subsection (c)(3), the Director shall consult with the Director of the Cybersecurity and Infrastructure Security Agency. (e) Responsibilities of CISA The Director of the Cybersecurity and Infrastructure Security Agency shall— (1) provide support to agencies with respect to the implementation of the requirements of this section; (2) develop tools, processes, and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section; (3) upon a request by an agency, assist the agency in the disclosure to vendors of newly identified security vulnerabilities in vendor products and services