; and (ii) if the report is not anonymous, when the reporter should anticipate an acknowledgment of receipt of the report by the agency; (C) include any other relevant information; and (D) be mature in scope and cover every internet accessible information system used or operated by that agency or on behalf of that agency. (3) Identified security vulnerabilities The head of each agency shall— (A) consider security vulnerabilities reported in accordance with paragraph (2); (B) commensurate with the risk posed by the security vulnerability, address such security vulnerability using the security vulnerability management process of the agency; and (C) in accordance with subsection (c)(5), provide information to the submitter of a vulnerability disclosure report. (g) Exemptions (1) In general The Director and the head of each agency shall carry out this section in a manner consistent with the protection of national security information. (2) Limitation The Director and the head of each agency may not publish under subsection (f)(1) or include in a vulnerability disclosure policy under subsection (f)(2) host names, services, information systems, or other information that the Director or the head of an agency, in coordination with the Director and other appropriate heads of agencies, determines would— (A) disrupt a law enforcement investigation; (B) endanger national security or intelligence activities; or (C) impede national defense activities or military operations. (3) National security systems This section shall not apply to national security systems. (h) Delegation of authority for certain systems The authorities of the Director and the Director of the Cybersecurity and Infrastructure Security Agency described in this section shall be delegated— (1) to the Secretary of Defense in the case of systems described in section 3553(e)(2)