; and (iii) describe— (I) the ongoing process and timeline for updating the framework; and (II) the incorporation of any additional work roles or competency areas in domains such as administration and finance, law and policy, ethics, privacy, human resources, information technology, operational technology, supply chain security, and acquisition and procurement. (2) Report on application and use of NICE framework Not later than 3 years after the date of the enactment of this Act and not less frequently than once every 3 years thereafter for 9 years, the Director shall, in consultation with industry, government, nonprofit, research, and academic institutions, submit to Congress a report that identifies— (A) applications and uses of the framework described in paragraph (1)(A) in practice; (B) any guidance that the program office of the National Initiative for Cybersecurity Education provides to increase adoption by employers and education and training providers of the work roles and competency areas for individuals who perform cybersecurity work at all proficiency levels; (C) available information regarding employer and education and training provider use of the framework; (D) an assessment of the use and effectiveness of the framework by and for individuals with nontraditional backgrounds or education, especially individuals making a career change or not pursuing a bachelor’s degree or higher